Problem with pki-tomcatd starting on 1 of 3 systems after upgrade from 4.2.0 to 4.5.4
by McCluskey, Chris
Hello,
I’m hoping somebody here can help with an issue I’m having with upgrades and ipaca. I have (3) CentOS 7.1.1503 based systems that I’m trying to upgrade from 4.2.0-15.0.1.el7 to ipa-server-4.5.4-10.el7. I’m able to upgrade the “second master” (dirsrv, DNS, ipaca backup) and “third master” (dirsrv, DNS, apace backup) without an issue (replication is good after 3-4 hours). But when I try to upgrade the “first master” (dirsrv, DNS, ipaca primary) the upgrade process completes successfully and starts the services, but the pki-tomcat fails to stay running. Odd thing is that it does run for about 4-5 minutes (I can see certificate data, and can list certificates from the CLI), but after about 5 minutes the whole IPA system stops (per the systemctl). I can run the IPA services on the “first master” (ipactl start --ignore-service-failures), but eventually the replication for ipaca fails — I suppose this is expected since pki-tomcat isn’t running (LDAP connection error from the “first master” to the “second/third masters”).
Funny thing is I’m not able to see anything in the logs that point to anything that shows as a fault. In referencing https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tom..., I wasn’t able to isolate anything that seems like it was related to the issue of pki-tomcatd terminating.
I eventually reverted all hosts back to a “safe snapshot” and reverted to keep the production systems active and in sync. I’m hoping the wise people here might be able to ID something amiss in the currently running systems before I make another attempt to get the systems upgraded again, or perhaps suggest superset of logs and data-points I would need to gather if it was to fail again.
Per https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tom... —
/var/log/ipaupgrade.log: Completed successfully
/var/log/pki/pki-tomcat/ca/debug: No trace/stack outputs. No strings marked as “error”.
Also checked catalina.out, and didn’t see anything amiss. There was a trace for a missing module (can’t remember the name right now and it isn’t in my notes), but the services and webapps started without it.
Certificate cert-pki-ca:
sudo certutil -L -d /etc/pki/pki-tomcat/alias -n 'Server-Cert cert-pki-ca' | grep 'Not'
Not Before: Sun Aug 20 22:02:05 2017
Not After : Sat Aug 10 22:02:05 2019
sudo certutil -L -d /etc/dirsrv/slapd-<removed>-<removed 2>-COM/ -n Server-Cert |grep "Not "
Not Before: Thu Aug 31 22:02:18 2017
Not After : Sun Sep 01 22:02:18 2019
sudo certutil -L -d /etc/httpd/alias/ -n Server-Cert |grep "Not "
Not Before: Thu Aug 31 22:02:08 2017
Not After : Sun Sep 01 22:02:08 2019
Was able to read cert using the password in /var/lib/pki/pki-tomcat/conf/password.conf.
In LDAP uid=pkidbuser,ou=people,o=ipaca userCertificate appears to be valid and matches what is in the NSSDB.
There are (8) certificates being monitored, and none have expired —
sudo getcert list
Number of certificates and requests being tracked: 8.
Request ID '20150928161427':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-<removed>-<removed 2>-COM',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-<removed>-<removed 2>-COM/pwdfile.txt'
certificate: type=NSSDB,location='/etc/dirsrv/slapd-<removed>-<removed 2>-COM',nickname='Server-Cert',token='NSS Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=<removed>.<removed 2>.COM
subject: CN=starfleet.<removed>.<removed 2>.com,O=<removed>.<removed 2>.COM
expires: 2019-09-01 22:02:18 UTC
principal name: ldap/starfleet.<removed>.<removed 2>.com@<removed>.<removed 2>.COM
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/lib64/ipa/certmonger/restart_dirsrv <removed>-<removed 2>-COM
track: yes
auto-renew: yes
Request ID '20150928161756':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=<removed>.<removed 2>.COM
subject: CN=starfleet.<removed>.<removed 2>.com,O=<removed>.<removed 2>.COM
expires: 2019-09-01 22:02:08 UTC
principal name: HTTP/starfleet.<removed>.<removed 2>.com@<removed>.<removed 2>.COM
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/lib64/ipa/certmonger/restart_httpd
track: yes
auto-renew: yes
Request ID '20160725201511':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=<removed>.<removed 2>.COM
subject: CN=CA Audit,O=<removed>.<removed 2>.COM
expires: 2019-08-10 22:04:31 UTC
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad
post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20160725201512':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=<removed>.<removed 2>.COM
subject: CN=OCSP Subsystem,O=<removed>.<removed 2>.COM
expires: 2019-08-10 22:02:50 UTC
eku: id-kp-OCSPSigning
pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad
post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20160725201513':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=<removed>.<removed 2>.COM
subject: CN=CA Subsystem,O=<removed>.<removed 2>.COM
expires: 2019-08-10 22:02:11 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad
post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20160725201514':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=<removed>.<removed 2>.COM
subject: CN=Certificate Authority,O=<removed>.<removed 2>.COM
expires: 2035-09-28 16:13:20 UTC
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad
post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20160725201515':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=<removed>.<removed 2>.COM
subject: CN=IPA RA,O=<removed>.<removed 2>.COM
expires: 2019-08-10 22:04:11 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/lib64/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/lib64/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Request ID '20160725201516':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-renew-agent
issuer: CN=Certificate Authority,O=<removed>.<removed 2>.COM
subject: CN=starfleet.<removed>.<removed 2>.com,O=<removed>.<removed 2>.COM
expires: 2019-08-10 22:02:05 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad
post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca"
track: yes
auto-renew: yes
Replication notes –
ipa server-role-find
-----------------------
18 server roles matched
-----------------------
Server name: federation.<removed>.<removed 2>.com
Role name: CA server
Role status: enabled
Server name: romulus.<removed>.<removed 2>.com
Role name: CA server
Role status: enabled
Server name: starfleet.<removed>.<removed 2>.com
Role name: CA server
Role status: enabled
Server name: federation.<removed>.<removed 2>.com
Role name: DNS server
Role status: enabled
Server name: romulus.<removed>.<removed 2>.com
Role name: DNS server
Role status: enabled
Server name: starfleet.<removed>.<removed 2>.com
Role name: DNS server
Role status: enabled
Server name: federation.<removed>.<removed 2>.com
Role name: NTP server
Role status: enabled
Server name: romulus.<removed>.<removed 2>.com
Role name: NTP server
Role status: enabled
Server name: starfleet.<removed>.<removed 2>.com
Role name: NTP server
Role status: absent
Server name: federation.<removed>.<removed 2>.com
Role name: AD trust agent
Role status: absent
Server name: romulus.<removed>.<removed 2>.com
Role name: AD trust agent
Role status: absent
Server name: starfleet.<removed>.<removed 2>.com
Role name: AD trust agent
Role status: absent
Server name: federation.<removed>.<removed 2>.com
Role name: KRA server
Role status: absent
Server name: romulus.<removed>.<removed 2>.com
Role name: KRA server
Role status: absent
Server name: starfleet.<removed>.<removed 2>.com
Role name: KRA server
Role status: absent
Server name: federation.<removed>.<removed 2>.com
Role name: AD trust controller
Role status: absent
Server name: romulus.<removed>.<removed 2>.com
Role name: AD trust controller
Role status: absent
Server name: starfleet.<removed>.<removed 2>.com
Role name: AD trust controller
Role status: absent
1) Are there other tests, reports, data that I can perform/provide with the systems in the “pre-upgrade” state that can help prove out the “pre-upgrade” state of the systems? I did run https://pypi.python.org/pypi/checkipaconsistency and cleaned up some stale RUVs, but they weren’t tried to an active replication agreement (previous “add” failures for the secondary and tertiary server).
2) Are there other points not discussed in https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tom... that I should be looking for in the event the service fails to start again?
3) Is there a superset of the list of files I should look for when pki-tomcat fails to start?
3a) Is searching for stack traces and “error” (case insensitive) in the logs sufficient search patterns or are there other searches and data that need to be looked at?
Thank you in advance for the assistance,
Chris
5 years, 7 months
Apache OTP Basic Auth
by Robert Gabriel
Hi,
Forgive me if this is a dumb question...
Is it possible to do password+OTP through Apache basic auth?
I have 2FA working for a user via Linux console/SSH login.
I have Apache working with Kerberos auth through FreeIPA:
<Directory />
AuthType Kerberos
AuthName "Web Server Login"
KrbMethodNegotiate On
KrbMethodK5Passwd On
Krb5KeyTab /etc/httpd/conf/http.keytab
require valid-user
</Directory>
If I enable 2FA and try password+OTP it fails as expected. Do I need a form login page or something?
If someone can at least guide me in the right direction I would be grateful.
Thank you.
5 years, 7 months
Stop samba sevice and winbind
by barrykfl@gmail.com
Hi all :
Any idea how to skip boot of smb.server and win bind ...or uninstall them
without affect ..thx
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: RUNNING
pki-tomcatd Service: RUNNING
smb Service: STOPPED
winbind Service: STOPPED
ipa-otpd Service: RUNNING
ipa: INFO: The ipactl command was successful
5 years, 7 months
Announcing SSSD 1.16.3
by Jakub Hrozek
SSSD 1.16.3
===========
The SSSD team is proud to announce the release of version 1.16.3 of the System Security Services Daemon.
The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/
RPM packages will be made available for Fedora shortly.
Feedback
————
Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Highlights
----------
New Features
^^^^^^^^^^^^
* The ``kdcinfo`` files that SSSD uses to inform libkrb5 about which KDCs
were discovered for a Kerberos realm used to be only generated for the
joined domain, not the trusted domains. Starting with this release, the
``kdcinfo`` files are generated automatically also for trusted domains in
setups that use ``id_provider=ad`` and IPA masters in a trust relationship
with an AD domain.
* The SSSD Kerberos locator plugin which processes the kdcinfo files and
actually tells libkrb5 about the available KDCs can now process multiple
address if SSSD generates more than one. At the moment, this feature
is only used on IPA clients (see below). Please see the
``sssd_krb5_locator_plugin(8)`` manual page for more information about
the Kerberos locator plugin.
* On IPA clients, the AD DCs or the AD site which should be used to
authenticate users can now be listed in a subdomain section. Please
see `the feature design page <https://docs.pagure.org/SSSD.sssd/design_pages/kdcinfo_improvements.html>`_
or the section "trusted domains configuration" for more details.
Notable bug fixes
^^^^^^^^^^^^^^^^^
* SECURITY: The permissions on ``/var/lib/sss/pipes/sudo`` were set
so that anyone could read anyone else's sudo rules. This was considered
an information leak and assigned CVE-2018-10852 (#3766)
* IMPORTANT: The 1.16.2 release was storing the cached passwords without
a salt prefix string. This bug was fixed in this release, but any
password hashes generated by 1.16.2 are incompatible with the hashes
generated by 1.16.3. The effect is that upgrade from 1.16.2 to 1.16.3
should be done when the authentication server is reachable so that the
first authentication after the upgrade fix the cached password.
* The ``sss_ssh`` proces leaked file descriptors when converting more than
one x509 certificate to SSH public key (#3794)
* SSSD, when configured with ``id_provider=ad`` was using too expensive
LDAP search to find out whether the required POSIX attributes
were replicated to the Global Catalog. Instead, SSSD now consults
the Partial Attribute Set, which is much more effective (#3755)
* The PAC responder is now able to process Domain Local in case the
PAC uses SID compression. Typicaly this is the case with Windows Server
2012 and newer (#3767)
* Some versions of OpenSSH (e.g. the one shipped in RHEL-7.5) would
close the pipe towards ``sss_ssh_authorizedkeys`` when the matching
key is found before the rest of the output is read. The
``sss_ssh_authorizedkeys`` helper was not handling this behaviour
well and would exit with SIGPIPE, which also meant the public key
authentication failed (#3747)
* User lookups no longer fail if user's e-mail address conflicts with
another user's fully qualified name (#3607)
* The ``override_shell`` and ``override_homedir`` options are no longer
applied to entries from the files domain. (#3758)
* Several bugs related to the FleetCommander integration were fixed (#3773,
#3774)
* The grace logins with an expired password when authenticating against
certain newer versions of the 389DS/RHDS LDAP server did not work (#3597)
* Whitespace around netgroup triple separator is now stripped
* The ``sss_ssh_knownhostproxy`` utility can now print the host key without
proxying the connection.
* Due to an overly restrictive check, the fast in-memory cache was sometimes
skipped, which caused a high load on the ``sssd_nss`` process (#3776).
Packaging Changes
-----------------
* The python2 bindings are not built by default on Fedora 29 or newer
* The sssd-secrets responder is now packaged in the sssd-kcm subpackage
and might be removed in a future release
Documentation Changes
---------------------
* ``sss_ssh_knownhostsproxy`` has a new option `-k/--print`.
Tickets Fixed
-------------
* `3796 <https://pagure.io/SSSD/sssd/issue/3796>`_ - The IPA selinux provider can return an error if SELinux is completely disabled
* `3794 <https://pagure.io/SSSD/sssd/issue/3794>`_ - sssd_ssh leaks file descriptors when more than one certificate is converted into an SSH key
* `3791 <https://pagure.io/SSSD/sssd/issue/3791>`_ - The cached password does not store the salt prefix
* `3778 <https://pagure.io/SSSD/sssd/issue/3778>`_ - When sssd is running as non-root user, the sudo pipe is created as sssd:sssd but then the private pipe ownership fails
* `3777 <https://pagure.io/SSSD/sssd/issue/3777>`_ - If access check for a privileged pipe fails, the responder loops indefinitely
* `3776 <https://pagure.io/SSSD/sssd/issue/3776>`_ - Spurious check in the sssd nss memcache can cause the memory cache to be skipped
* `3774 <https://pagure.io/SSSD/sssd/issue/3774>`_ - Desktop Profile: The 10th policy is producing a wrong file name
* `3773 <https://pagure.io/SSSD/sssd/issue/3773>`_ - SSSD bails out saving desktop profiles in case an invalid profile is found
* `3767 <https://pagure.io/SSSD/sssd/issue/3767>`_ - Groups go missing with PAC enabled in sssd
* `3766 <https://pagure.io/SSSD/sssd/issue/3766>`_ - CVE-2018-10852: information leak from the sssd-sudo responder
* `3758 <https://pagure.io/SSSD/sssd/issue/3758>`_ - override_homedir should not apply to the files provider
* `3755 <https://pagure.io/SSSD/sssd/issue/3755>`_ - The search filter for detecting POSIX attributes in global catalog is too broad and can cause a high load on the servers
* `3754 <https://pagure.io/SSSD/sssd/issue/3754>`_ - SSSD AD uses LDAP filter to detect POSIX attributes stored in AD GC also for regular AD DC queries
* `3747 <https://pagure.io/SSSD/sssd/issue/3747>`_ - sss_ssh_authorizedkeys exits abruptly if SSHD closes its end of the pipe before reading all the SSH keys
* `3652 <https://pagure.io/SSSD/sssd/issue/3652>`_ - kdcinfo doesn't get populated for other domains
* `3607 <https://pagure.io/SSSD/sssd/issue/3607>`_ - Handle conflicting e-mail addresses more gracefully
* `3597 <https://pagure.io/SSSD/sssd/issue/3597>`_ - sssd doesn't allow user with expired password to login when PasswordgraceLimit set
* `3596 <https://pagure.io/SSSD/sssd/issue/3596>`_ - A combination of the same qualified and unqualified sudoUser causes Error: 17: File exists
* `3542 <https://pagure.io/SSSD/sssd/issue/3542>`_ - Get host key without proxying connection
* `3475 <https://pagure.io/SSSD/sssd/issue/3475>`_ - Full information regarding priority of lookup of principal in keytab not in man page
* `3291 <https://pagure.io/SSSD/sssd/issue/3291>`_ - RFE: sssd in cross realm trust configuration should be use AD KDC from a list or site defined in the config file
Detailed Changelog
------------------
* Alexander Bokovoy (2):
* ipa provider: always use a special keytab to talk to a trusted DC
* ipa provider: expand search base to cover trusted domain objects
* Alexey Sheplyakov (1):
* nss: skip incomplete groups instead of bailing out
* Amit Kumar (1):
* Responder: simplify if-else structure in sss_dp_get_account_msg()
* Fabiano Fidêncio (18):
* intg: Do not hardcode nsslibdir
* files: do not apply override_homedir to files provider
* tests: add override_homedir tests for files provider
* files: do not apply override_shell to files provider
* tests: add override_shell tests for files provider
* util: add is_files_provider() helper
* files: make use of is_files_provider() helper
* cache_req: keep the files provider as the first domain to be searched
* tests: add basic tests for cache_req_domain_new_list_from_domain_resolution_order()
* tests: add a test to ensure the output_fqnames is false for files provider
* deskprofile: don't bail if we fail to save one profile
* sdap: respect passwordGracelimit
* deskprofile: fix a typo in _get_filename_path()
* tests: add tests for ipa_deskprofile_get_filename_path()
* util: introduce sss_ssh_print_pubkey()
* ssh: make use of sss_ssh_print_pubkey()
* sss_ssh_knownhostsproxy: add option to only print the pubkey
* nss: remove unused label
* Jakub Hrozek (38):
* Bumping the version to track the 1.16.3 development
* TESTS: Extend the schema with sshPublicKey attribute
* TESTS: Allow adding sshPublicKey for users
* TESTS: Add a basic SSH responder test
* SSH: Do not exit abruptly if SSHD closes its end of the pipe before reading all the SSH keys
* TESTS: Add a helper binary that can trigger the SIGPIPE to authorizedkeys
* TESTS: Add a regression test for SIGHUP handling in sss_ssh_authorizedkeys
* Revert "LDAP/IPA: add local email address to aliases"
* util: Remove the unused function is_email_from_domain
* TESTS: Allow storing e-mail address for users
* TESTS: Add regression test for looking up users with conflicting e-mail addresses
* AD/LDAP: Do not misuse the ignore_mark_offline to check if a connection needs to be checked for POSIX attribute presence
* MAN: Remove outdated notes from the re_expression description
* MAN: Document the re_expression needed to suport @-signs in the groupnames
* SUDO: Create the socket with stricter permissions
* AD: expose the helper function to format the site DNS query
* RESOLV: Add a resolv_hostport_list request
* KRB5/IPA/AD: Add a utility function to create a krb5_service instance
* KRB5: Allow writing multiple addresses to the kdcinfo plugin
* IPA: Add the options that the IPA subdomains code will read for trusted domains on the client
* IPA: Populate kdcinfo files on trust clients with configured AD servers
* MAN: Document the options available for AD trusted domains
* SDAP: Detect schemaNamingContext from the rootDSE
* AD: Add Global Catalog usability check in subdomain code by looking at the schema
* AD: Remove the legacy check from ad_get_account_domain_posix_check request
* LDAP/AD: Remove the legacy POSIX check from user, group and enumeration searches
* LDAP: Remove the legacy POSIX check itself
* sudo testcli: Use hand-crafted JSON for output so that the test CLI is usable in tests
* TESTS: Load the sudo schema in the default OpenLDAP test instance and create ou=sudoers
* TESTS: Add API to add sudo rules in tests
* TESTS: Add a simple sudo LDAP test
* SUDO: Don't save duplicates when saving qualified names
* crypto: Silence a Coverity warning in OpenSSL version of sss_hmac_sha1()
* crypto: Make one condition more defensive in NSS version of sss_hmac_sha1()
* SDAP: Improve a confusing DEBUG message when initgroups search matches multiple entries
* RESP: Terminate client connection if the permissions check on the priv pipe fails
* SELINUX: Also call is_selinux_enabled as a check for selinux child
* P11: Don't return int failure from a bool function
* Josef Cejka (1):
* Strip whitespaces in netgroup triple.
* Lukas Slebodnik (15):
* sss_seed: Remove unused parameter from seed_domain_user_info
* SUDO: Fix running in unprivileged responder
* SUDO: Root should be able to read/write sssd-sudo socket
* SPEC: Drop unnecessary check for minor version of el7
* test_ssh_client: Do not ignore failure from read
* SPEC: Move openssl deps away from unit tests deps
* PYTHON: Avoid warnings with python3.7
* SPEC: Move secrets responder to the package sssd-kcm
* SPEC: Do not build python2 bindings on latest distros
* BUILD: Replace also runstatedir in templates
* SYSTEMD: Allow to use "/run" in ListenStream
* Revert "Revert "CRYPTO: Suppress warning Wstringop-truncation""
* CRYPTO: Save prefix in s3crypt_sha512
* crypto-tests: Add unit test for s3crypt_sha512
* SSS_CERT: Close file descriptors after executing p11_child
* Michal Židek (1):
* Revert "CRYPTO: Suppress warning Wstringop-truncation"
* Stanislav Levin (1):
* Fix "test-find-uid" and "find_uid-tests" tests
* Sumit Bose (14):
* krb5 locator: add support for multiple addresses
* krb5 locator: fix IPv6 support
* krb5 locator: make plugin more robust
* krb5 locator: add unit tests
* AD/IPA: Create kdcinfo file for sub-domains
* krb5: refactor removal of krb5info files
* krb5_common: add callback only once
* data provider: run offline callbacks only once
* utils: add libsss_child dependency to libsss_cert
* AD: consider resource_groups in PAC as well
* utils: make create_ipa_preauth_indicator() public as create_preauth_indicator()
* PAM: create pre-auth indicator file
* MC: Remove check if record is in the mapped address space
* tests: fix sss_nss_idmap-tests
* amitkumar50 (1):
* MAN: Give information regarding priority of ldap lookup
5 years, 7 months
/etc/httpd/alias not getting renewed cert
by Thomas Letherby
Hello all,
I had an issue a short while ago with a replica which turned out to be an
expired certificate which I renewed and all seemed good.
Seemed...
It now appears that although the certificate renewed as seen by getcert
-list, it didn't update /etc/httpd/alias and so the httpd and tomcat-pki
services won't start unless I set the date to before the certificate
expired, and even then sometimes the httpd error_log shows:
Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off"
to nss.conf so the server can start until the problem can be resolved.
and the service fails to start.
I've tried resubmitting the certificate, and it doesn't seem to throw an
error, but it doesn't update /alias either.
Trying to access the server via the web page shows the old certificate
still in use.
I see the same certificate error with the replica server, which was freshly
rebuilt and added last week.
I've doubtless dug further into the hole trying to troubleshoot this, so I
probably need to start from the beginning again, and a pointer in the right
direction would be a great help!
A getcert list shows all the certificates expiry dates well into the future.
How can I get the certs back in sync? I've found a few guides and most seem
to be for earlier versions, and I'm not sure if they're still current.
I can post whatever logs you think will help, I'm afraid I'm not familiar
enough with them all to tell which are the most relevant. Is there a guide
for the logs?
Thanks for any help you can give,
Thomas
5 years, 7 months
_srv_
by Alfredo De Luca
Hi all.
If I don't have freeipa dns and we use external DNS and I wanted to use
_srv_ for all the clients to connect automatically when a master goes down
what should I do on the DNS server?
I tried to have
master1.mydom.test SRV
replica1.mydon.test SRV
etc etc... but I don't think is working
Cheers
--
*Alfredo*
5 years, 7 months
SPF records returned broken by FreeIPA DNS
by Balg, Andreas
Hi there,
Our FreeIPA DNS returns the SPFrecords erroneously and as one string
without spaces allthough the record is correctly stored and setup
in the WebUI:
This is what the query gets as answer:
v=spf1mxip4:27.126.144.5/32ip4:27.126.144.2/32~all
If I copy and Paste the record from the web UI its correct:
TXT v=spf1 mx ip4:27.126.144.5/32 ip4:27.126.144.2/32 ~all
Packages installed are:
ipa-server-4.5.4-10.el7.centos.x86_64
ipa-server-dns-4.5.4-10.el7.centos.noarch
ipa-common-4.5.4-10.el7.centos.noarch
How can we fix this asap - of course the syntactically wrong SPF
response causes big trouble with mails?
--
Andreas Balg
Senior Site Reliability Engineer DevOps
------------------------------------------------------------------
Haufe-umantis AG
Ein Unternehmen der Haufe Gruppe
Unterstrasse 11, CH-9001 St.Gallen
Tel. +41 71 224 01 52, Fax +41 71 224 01 02
E-Mail: andreas.balg(a)haufe.com
5 years, 7 months
Re: IPA and AD basedn
by Mirko Spezie
This is the output from both IPA server and client:
From IPA Server:
# id mspezie(a)example.org
uid=1070607073(mspezie(a)example.org) gid=1070607073(mspezie(a)example.org) groups=1070607073(mspezie(a)example.org)
1070603934(linux power users(a)example.org)
1070600512(domain admins(a)example.org)
1535800006(ad_admins)
1535800000(admins)
....
1070600513(domain users(a)example.org)
# id freeipa(a)example.org
uid=1070607388(freeipa(a)example.org) gid=1070607388(freeipa(a)example.org) groups=1070607388(freeipa(a)example.org)
1070600513(domain users(a)example.org)
1535800006(ad_admins)
1535800000(admins)
From IPA Client:
# id mspezie(a)example.org
id: mspezie(a)example.org: no such user
# id freeipa(a)example.org
uid=1070607388(freeipa(a)example.org) gid=1070607388(freeipa(a)example.org) groups=1070607388(freeipa(a)example.org)
1070600513(domain users(a)example.org)
1535800006(ad_admins)
1535800000(admins)
The only difference from these two accounts is that freeipa(a)example.org is present in cn=Users and mspezie(a)example.org not.
All the AD groups associated to mspezie have a name
5 years, 7 months
sss_ssh_authorizedkeys returns empty list
by Peter Viskup
On Debian 9 client the sss_ssh_authorizedkeys command returns empty
list. But the ipauser has SSH key in its IPA profile setup via web UI.
Debug log does not point to any error:
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [get_client_cred] (0x4000):
Client creds: euid[65534] egid[65534] pid[11834].
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [get_client_cred] (0x0080): The
following failure is expected to happen in case SELinux is disabled:
SELINUX_getpeercon failed [92][Protocol not available].
Please, consider enabling SELinux in your system.
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [setup_client_idle_timer]
(0x4000): Idle timer re-set for client [0x56353b9b65a0][18]
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [accept_fd_handler] (0x0400):
Client connected!
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_cmd_get_version] (0x0200):
Received client version [0].
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_cmd_get_version] (0x0200):
Offered version [0].
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ssh_cmd_parse_request]
(0x0400): Requested domain [DOMAIN]
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ssh_cmd_parse_request]
(0x0400): Parsing name [ipauser][DOMAIN]
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_parse_name_for_domains]
(0x0200): name 'ipauser' matched without domain, user is ipauser
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_parse_name_for_domains]
(0x0200): using default domain [DOMAIN]
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_ssh_cmd_get_user_pubkeys]
(0x0400): Requesting SSH user public keys for [ipauser] from [DOMAIN]
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_dp_issue_request]
(0x0400): Issuing request for [0x56353a7ea5f0:1:ipauser@DOMAIN@DOMAIN]
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_dp_get_account_msg]
(0x0400): Creating request for
[DOMAIN][0x1][BE_REQ_USER][name=ipauser@DOMAIN:-]
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sbus_add_timeout] (0x2000):
0x56353b9b8fc0
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_dp_internal_get_send]
(0x0400): Entering request [0x56353a7ea5f0:1:ipauser@DOMAIN@DOMAIN]
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sbus_remove_timeout] (0x2000):
0x56353b9b8fc0
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sbus_dispatch] (0x4000): dbus
conn: 0x56353b9af060
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sbus_dispatch] (0x4000): Dispatching.
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_dp_get_reply] (0x1000):
Got reply from Data Provider - DP error code: 0 errno: 0 error
message: Success
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ssh_user_pubkeys_search_next]
(0x0400): Requesting SSH user public keys for [ipauser@DOMAIN]
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Added timed
event "ltdb_callback": 0x56353b9bdcd0
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Added timed
event "ltdb_timeout": 0x56353b9bdd90
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Running timer
event 0x56353b9bdcd0 "ltdb_callback"
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Destroying
timer event 0x56353b9bdd90 "ltdb_timeout"
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Ending timer
event 0x56353b9bdcd0 "ltdb_callback"
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Added timed
event "ltdb_callback": 0x56353b9b90e0
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Added timed
event "ltdb_timeout": 0x56353b9b98e0
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Running timer
event 0x56353b9b90e0 "ltdb_callback"
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Destroying
timer event 0x56353b9b98e0 "ltdb_timeout"
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Ending timer
event 0x56353b9b90e0 "ltdb_callback"
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_dp_req_destructor]
(0x0400): Deleting request: [0x56353a7ea5f0:1:ipauser@DOMAIN@DOMAIN]
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [client_recv] (0x0200): Client
disconnected!
(Wed Aug 8 10:54:01 2018) [sssd[ssh]] [client_close_fn] (0x2000):
Terminated client [0x56353b9b65a0][18]
What could be the root cause?
--
Peter
5 years, 7 months