Issue with creating CA replica/how to do so
by Jared Biel
Hello,
I'm trying to add a CA replica to an already established "regular" replica
and am unable to do so. Can anyone point me to instructions for how to do
this? It seems like maybe some files need to be manually copied over from
the existing replica but none of the instructions that I've found mention
this. The existing CA is running 4.5.4 and the new replica is 4.7.0 (I'm
trying to migrate to 4.7.0 entirely.)
Regarding the output below, /var/log/pki/pki-tomcat does not exist and
there are only 2 uninteresting files in /var/log/pki.
Thanks.
# ipa-ca-install
Directory Manager (existing master) password:
ipaclient.install.ipa_certupdate: ERROR Failed to add lightweight CA
tracking requests
Traceback (most recent call last):
File
"/usr/lib/python3.6/site-packages/ipaclient/install/ipa_certupdate.py",
line 117, in run_with_args
cainstance.add_lightweight_ca_tracking_requests(lwcas)
File "/usr/lib/python3.6/site-packages/ipaserver/install/cainstance.py",
line 1914, in add_lightweight_ca_tracking_requests
pin=certmonger.get_pin('internal'),
File "/usr/lib/python3.6/site-packages/ipalib/install/certmonger.py",
line 672, in get_pin
with open(paths.PKI_TOMCAT_PASSWORD_CONF, 'r') as f:
FileNotFoundError: [Errno 2] No such file or directory:
'/etc/pki/pki-tomcat/password.conf'
Run connection check to master
Connection check OK
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
[1/26]: creating certificate server db
[2/26]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 5 seconds elapsed
Update succeeded
[3/26]: creating ACIs for admin
[4/26]: creating installation admin user
[5/26]: configuring certificate server instance
ipaserver.install.dogtaginstance: CRITICAL Failed to configure CA instance:
CalledProcessError(Command ['/usr/sbin/pkispawn', '-s', 'CA', '-f',
'/tmp/tmp0n1ii3z2'] returned non-zero exit status 1: '')
ipaserver.install.dogtaginstance: CRITICAL See the installation logs and
the following files/directories for more information:
ipaserver.install.dogtaginstance: CRITICAL /var/log/pki/pki-tomcat
[error] RuntimeError: CA configuration failed.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
CA configuration failed.
5 years, 7 months
confused about ipa-dns-install not creating reverse zone
by Harald Dunkel
Hi folks,
I am confused: Setting up a new freeipa service (CentOS 7.5) using
ipa-server-install or ipa-dns-install it asks me
Do you want to search for missing reverse zones? [yes]: yes
But then it did not create a reverse zone :-(.
This doesn't look like documented. There is no "--no-reverse", it
did not list any reverse zones it has found, so it should have asked
"Do you want to configure the reverse zone?".
How can I tell ipa-dns-install to create a reverse zone (no matter
what), suitable for dynamic updates, before it adds its own host
name and IPv4 address to the database?
Every helpful comment is highly appreciated.
Harri
-------------------------------------------------------------------------
[root@idms01 centos]# ipa-dns-install
The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will setup DNS for the IPA Server.
This includes:
* Configure DNS (bind)
* Configure SoftHSM (required by DNSSEC)
* Configure ipa-dnskeysyncd (required by DNSSEC)
NOTE: DNSSEC zone signing is not enabled by default
To accept the default shown in brackets, press the Enter key.
Do you want to configure DNS forwarders? [yes]:
Following DNS servers are configured in /etc/resolv.conf: 127.0.0.1
Do you want to configure these servers as DNS forwarders? [yes]: no
Enter an IP address for a DNS forwarder, or press Enter to skip: 1.1.1.1
DNS forwarder 1.1.1.1 added. You may add another.
Enter an IP address for a DNS forwarder, or press Enter to skip:
Checking DNS forwarders, please wait ...
Do you want to search for missing reverse zones? [yes]: yes
The following operations may take some minutes to complete.
Please wait until the prompt is returned.
Configuring DNS (named)
[1/9]: generating rndc key file
[2/9]: setting up our zone
[3/9]: setting up our own record
[4/9]: adding NS record to the zones
[5/9]: setting up kerberos principal
[6/9]: setting up named.conf
[7/9]: setting up server configuration
[8/9]: configuring named to start on boot
[9/9]: changing resolv.conf to point to ourselves
Done configuring DNS (named).
Restarting the web server to pick up resolv.conf changes
Configuring DNS key synchronization service (ipa-dnskeysyncd)
[1/7]: checking status
[2/7]: setting up bind-dyndb-ldap working directory
[3/7]: setting up kerberos principal
[4/7]: setting up SoftHSM
[5/7]: adding DNSSEC containers
[6/7]: creating replica keys
[7/7]: configuring ipa-dnskeysyncd to start on boot
Done configuring DNS key synchronization service (ipa-dnskeysyncd).
Restarting ipa-dnskeysyncd
Restarting named
Updating DNS system records
==============================================================================
Setup complete
Global DNS configuration in LDAP server is empty
You can use 'dnsconfig-mod' command to set global DNS options that
would override settings in local named.conf files
You must make sure these network ports are open:
TCP Ports:
* 53: bind
UDP Ports:
* 53: bind
[root@idms01 centos]# ipa dnszone-find
Zone name: example.eu.
Active zone: TRUE
Authoritative nameserver: idms01.example.eu.
Administrator e-mail address: hostmaster.example.eu.
SOA serial: 1533217523
SOA refresh: 3600
SOA retry: 900
SOA expire: 1209600
SOA minimum: 3600
Allow query: any;
Allow transfer: none;
----------------------------
Number of entries returned 1
----------------------------
5 years, 7 months
DNS Forwarders
by Andrew Meyer
Is it possible to have a per server zone forwarder in /etc/named.conf and NOT break replication?
5 years, 7 months
DNS issues
by Andrew Meyer
So I've had my FreeIPA setup for about 6 months now at my company. As of recently i'm seeing some issues where if I try to dig against the servers I get nothing back. I do not have a global forwarder setup because it should automatically go outbound if its not in its own table, correct?
This only seems to be an issue on 2 out of 4 of my servers.
Also my forwarding policy is forward first.
My environment has 2 IPA servers in my local office and 2 IPA server in my AWS VPC. We have a legacy domain that I am forwarding to our legacy nameservers until those get turned off.
There is not much in the logs to tell me if there is an issue (at least that I can see). Usually a reboot helps but that can't be the answer all the time.
Any thoughts?
All 4 servers are running CentOS 7.4FreeIPA version 4.5.0
Thanks!
5 years, 7 months
Trust from AD to IPA?
by Chris Adams
At my work, we've been tasked with setting up Active Directory for
managing Windows desktop policy and users. We already have FreeIPA set
up (although it needs to be rebuilt) for some of our users, groups, and
Linux server policy. None of this is a huge setup (a few hundred
users).
We're considering having all the users defined in FreeIPA, and then just
having AD for the Windows computer policy, and setting AD up with a
one-way trust to FreeIPA. It seems like there's several documents that
talk about going the other way, but I'm not finding much for this.
Is this a reasonable approach - any issues we might run into? Is there
a good document for setting up a one-way trust from AD to IPA?
Thanks.
--
Chris Adams <linux(a)cmadams.net>
5 years, 7 months
Do you want to search for missing reverse zones?
by Harald Dunkel
Hi folks,
I am confused: Setting up a new freeipa service (CentOS 7.5) using
ipa-server-install or ipa-dns-install it asks me
Do you want to search for missing reverse zones? [yes]: yes
But then it did not create a reverse zone :-( This doesn't look like
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
Is this a good thing? How can I tell ipa-dns-install to create a
reverse zone, no matter what?
Every helpful comment is highly appreciated.
Harri
-------------------------------------------------------------------------
[root@idms01 centos]# ls -al /etc/resolv.conf
ls: cannot access /etc/resolv.conf: No such file or directory
[root@idms01 centos]# ipa-dns-install
The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will setup DNS for the IPA Server.
This includes:
* Configure DNS (bind)
* Configure SoftHSM (required by DNSSEC)
* Configure ipa-dnskeysyncd (required by DNSSEC)
NOTE: DNSSEC zone signing is not enabled by default
To accept the default shown in brackets, press the Enter key.
Do you want to configure DNS forwarders? [yes]:
Following DNS servers are configured in /etc/resolv.conf: 127.0.0.1
Do you want to configure these servers as DNS forwarders? [yes]: no
Enter an IP address for a DNS forwarder, or press Enter to skip: 1.1.1.1
DNS forwarder 1.1.1.1 added. You may add another.
Enter an IP address for a DNS forwarder, or press Enter to skip:
Checking DNS forwarders, please wait ...
Do you want to search for missing reverse zones? [yes]: yes
The following operations may take some minutes to complete.
Please wait until the prompt is returned.
Configuring DNS (named)
[1/8]: generating rndc key file
[2/8]: setting up our own record
[3/8]: adding NS record to the zones
[4/8]: setting up kerberos principal
[5/8]: setting up named.conf
[6/8]: setting up server configuration
[7/8]: configuring named to start on boot
[8/8]: changing resolv.conf to point to ourselves
Done configuring DNS (named).
Restarting the web server to pick up resolv.conf changes
Configuring DNS key synchronization service (ipa-dnskeysyncd)
[1/7]: checking status
[2/7]: setting up bind-dyndb-ldap working directory
[3/7]: setting up kerberos principal
[4/7]: setting up SoftHSM
[5/7]: adding DNSSEC containers
[6/7]: creating replica keys
[7/7]: configuring ipa-dnskeysyncd to start on boot
Done configuring DNS key synchronization service (ipa-dnskeysyncd).
Restarting ipa-dnskeysyncd
Restarting named
Updating DNS system records
==============================================================================
Setup complete
Global DNS configuration in LDAP server is empty
You can use 'dnsconfig-mod' command to set global DNS options that
would override settings in local named.conf files
You must make sure these network ports are open:
TCP Ports:
* 53: bind
UDP Ports:
* 53: bind
5 years, 7 months
Creating CA replica fails
by Aaron Hicks
Hello the List,
I'm successfully replicating IPA and DNS across two sites, however when I
try and replicate CA it fails:
[root@ipa01 pki]# ipa-ca-install
Directory Manager (existing master) password:
Run connection check to master
Connection check OK
/usr/lib/python2.7/site-packages/urllib3/connection.py:251: SecurityWarning:
Certificate has no `subjectAltName`, falling back to check for a
`commonName` for now. This feature is being removed by major browsers and
deprecated by RFC 2818. (See https://github.com/shazow/urllib3/issues/497
for details.)
SecurityWarning
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
[1/25]: creating certificate server db
[2/25]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 5 seconds elapsed
Update succeeded
[3/25]: creating installation admin user
[4/25]: configuring certificate server instance
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA
instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpaJdg1W' returned
non-zero exit status 1
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation
logs and the following files/directories for more information:
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL
/var/log/pki/pki-tomcat
[error] RuntimeError: CA configuration failed.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
CA configuration failed.
When I check the logs in /var/log/ipareplica-ca-install.log
<snip all good>
2018-08-02T04:40:15Z DEBUG Starting external process
2018-08-02T04:40:15Z DEBUG args=/usr/sbin/pkispawn -s CA -f /tmp/tmpaJdg1W
2018-08-02T04:45:31Z DEBUG Process finished, return code=1
2018-08-02T04:45:31Z DEBUG stdout=Log file:
/var/log/pki/pki-ca-spawn.20180802044015.log
Loading deployment configuration from /tmp/tmpaJdg1W.
WARNING: The 'pki_ssl_server_nickname' in [CA] has been deprecated. Use
'pki_sslserver_nickname' instead.
WARNING: The 'pki_ssl_server_subject_dn' in [CA] has been deprecated. Use
'pki_sslserver_subject_dn' instead.
Installing CA into /var/lib/pki/pki-tomcat.
Storing deployment configuration into
/etc/sysconfig/pki/tomcat/pki-tomcat/ca/deployment.cfg.
Importing certificates from /tmp/ca.p12:
<snip a certificate>
Installation failed:
Please check the CA logs in q.
2018-08-02T04:45:31Z DEBUG stderr=
2018-08-02T04:45:31Z CRITICAL Failed to configure CA instance: Command
'/usr/sbin/pkispawn -s CA -f /tmp/tmpaJdg1W
' returned non-zero exit status 1
2018-08-02T04:45:31Z CRITICAL See the installation logs and the following
files/directories for more information:
2018-08-02T04:45:31Z CRITICAL /var/log/pki/pki-tomcat
2018-08-02T04:45:31Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line
504, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line
494, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py",
line 616, in __spawn_instance
self.tmp_agent_pwd)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line
148, in spawn_instance
self.handle_setup_error(e)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line
386, in handle_setup_error
raise RuntimeError("%s configuration failed." % self.subsystem)
RuntimeError: CA configuration failed.
2018-08-02T04:45:31Z DEBUG [error] RuntimeError: CA configuration failed.
2018-08-02T04:45:31Z DEBUG File
"/usr/lib/python2.7/site-packages/ipaserver/install/installutils.py", line
998,
in run_script
return_value = main_function()
File "/sbin/ipa-ca-install", line 309, in main
promote(safe_options, options, filename)
File "/sbin/ipa-ca-install", line 277, in promote
install_replica(safe_options, options, filename)
File "/sbin/ipa-ca-install", line 207, in install_replica
ca.install(True, config, options, custodia=custodia)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 202,
in install
install_step_0(standalone, replica_config, options, custodia=custodia)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 279,
in install_step_0
use_ldaps=standalone)
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py",
line 448, in configure_instance
self.start_creation(runtime=runtime)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line
504, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line
494, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py",
line 616, in __spawn_instance
self.tmp_agent_pwd)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line
148, in spawn_instance
self.handle_setup_error(e)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line
386, in handle_setup_error
raise RuntimeError("%s configuration failed." % self.subsystem)
2018-08-02T04:45:31Z DEBUG The ipa-ca-install command failed, exception:
RuntimeError: CA configuration failed.
5 years, 7 months
ERR - attrlist_replace - attr_replace (nsslapd-referral,
by James Harrison
Hello,
We have a machine with the following set up:
CentOS Linux release 7.4.1708 (Core)ipa-server-4.5.0-21.el7.centos.2.2.x86_64
CA-less setup
We're getting a lot of errors on one of our FreeIPA servers. Hope you can help.
Many thanksJames Harrison
[31/Jul/2018:12:19:05.542401358 +0100] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=int,dc=DOMAIN,dc=com--no CoS Templates found, which should be added before the CoS Definition.
[31/Jul/2018:12:19:05.611267011 +0100] - ERR - attrlist_replace - attr_replace (nsslapd-referral, ldap://cro-system-02.DOMAINNAME:389/dc%3Dint%2Cdc%3DDOMAIN%2Cdc%3Dcom) failed.
[31/Jul/2018:12:19:05.613868420 +0100] - ERR - attrlist_replace - attr_replace (nsslapd-referral, ldap://cro-system-02.DOMAINNAME:389/dc%3Dint%2Cdc%3DDOMAIN%2Cdc%3Dcom) failed.
[31/Jul/2018:12:19:05.634974836 +0100] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds!
[31/Jul/2018:12:19:05.646685174 +0100] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/pul-system-01.DOMAINNAME@DOMAINNAME] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328324 (Generic error (see e-text))
[31/Jul/2018:12:19:05.657290290 +0100] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests
[31/Jul/2018:12:19:05.660478907 +0100] - INFO - slapd_daemon - Listening on All Interfaces port 636 for LDAPS requests
[31/Jul/2018:12:19:05.664268080 +0100] - INFO - slapd_daemon - Listening on /var/run/slapd-INT-DOMAIN-COM.socket for LDAPI requests
[31/Jul/2018:12:19:05.712942138 +0100] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=pul-system-01.DOMAINNAME-to-pul-system-02.DOMAINNAME" (pul-system-02:389) - Replication bind with GSSAPI auth failed: LDAP error -6 (Unknown authentication method) (SASL(-4): no mechanism available: No worthy mechs found)
[31/Jul/2018:12:19:08.916600270 +0100] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=pul-system-01.DOMAINNAME-to-pul-system-02.DOMAINNAME" (pul-system-02:389): Replication bind with GSSAPI auth resumed
[31/Jul/2018:12:19:11.139026788 +0100] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=int,dc=DOMAIN,dc=com
[31/Jul/2018:12:19:11.143128988 +0100] - ERR - schema-compat-plugin - Finished plugin initialization.
[31/Jul/2018:12:19:26.258468102 +0100] - ERR - ipa-topology-plugin - ipa_topo_util_get_replica_conf: server configuration missing
[31/Jul/2018:12:19:26.261488755 +0100] - ERR - ipa-topology-plugin - ipa_topo_util_get_replica_conf: cannot create replica
[31/Jul/2018:12:19:41.405312942 +0100] - ERR - attrlist_replace - attr_replace (nsslapd-referral, ldap://cro-system-02.DOMAINNAME:389/dc%3Dint%2Cdc%3DDOMAIN%2Cdc%3Dcom) failed.
[31/Jul/2018:12:19:41.407352984 +0100] - ERR - attrlist_replace - attr_replace (nsslapd-referral, ldap://cro-system-02.DOMAINNAME:389/dc%3Dint%2Cdc%3DDOMAIN%2Cdc%3Dcom) failed.
[31/Jul/2018:12:19:41.409312145 +0100] - ERR - attrlist_replace - attr_replace (nsslapd-referral, ldap://cro-system-02.DOMAINNAME:389/dc%3Dint%2Cdc%3DDOMAIN%2Cdc%3Dcom) failed.
[31/Jul/2018:12:19:44.484329977 +0100] - ERR - attrlist_replace - attr_replace (nsslapd-referral, ldap://hk-system-02.DOMAINNAME:389/dc%3Dint%2Cdc%3DDOMAIN%2Cdc%3Dcom) failed.
[31/Jul/2018:12:19:44.489032389 +0100] - ERR - attrlist_replace - attr_replace (nsslapd-referral, ldap://hk-system-02.DOMAINNAME:389/dc%3Dint%2Cdc%3DDOMAIN%2Cdc%3Dcom) failed.
[31/Jul/2018:12:19:44.490775486 +0100] - ERR - attrlist_replace - attr_replace (nsslapd-referral, ldap://hk-system-02.DOMAINNAME:389/dc%3Dint%2Cdc%3DDOMAIN%2Cdc%3Dcom) failed.
[31/Jul/2018:12:19:46.882743610 +0100] - ERR - attrlist_replace - attr_replace (nsslapd-referral, ldap://hk-system-02.DOMAINNAME:389/dc%3Dint%2Cdc%3DDOMAIN%2Cdc%3Dcom) failed.
[31/Jul/2018:12:19:46.887246145 +0100] - ERR - attrlist_replace - attr_replace (nsslapd-referral, ldap://hk-system-02.DOMAINNAME:389/dc%3Dint%2Cdc%3DDOMAIN%2Cdc%3Dcom) failed.
[31/Jul/2018:12:19:46.889667896 +0100] - ERR - attrlist_replace - attr_replace (nsslapd-referral, ldap://hk-system-02.DOMAINNAME:389/dc%3Dint%2Cdc%3DDOMAIN%2Cdc%3Dcom) failed.
5 years, 7 months
Prevent users reading other users' data from the WebUI
by Callum Smith
Dear All,
Seems this has come up before but the previous fix no longer works. Is there a way to do this through the Roles, because it doesn't seem obvious to me immediately? Any help welcomed!
Regards,
Callum
--
Callum Smith
Research Computing Core
Wellcome Trust Centre for Human Genetics
University of Oxford
e. callum(a)well.ox.ac.uk<mailto:callum@well.ox.ac.uk>
5 years, 7 months
Problem with replication topology after replica removal
by Przemysław Orzechowski
Hi
I removed a replica but after removal i got 3 undeleted replication
agreements
I can't delete it with ipa topologysegment-del
error returned
ipa: ERROR: Server is unwilling to perform: Removal of Segment
disconnects topology.Deletion not allowed.
ipa host-find
Return no results as expected.
Is there any way to fix this ?
Regards
Przemysław Orzechowski
5 years, 7 months