DHCP + FreeIPA: How to ensure DHCP only servers those IP's NOT defined in FreeIPA DNS?
by TomK
Hey All,
Would like to ensure that if a DHCP server issues an IP, that it also
checks the FreeIPA (DNS) to ensure that IP hasn't been defined before.
Anyway to do that?
Currently if a virtual host has been offline for a while, the DHCP
serves it's IP to new hosts being built.
--
Cheers,
Tom K.
-------------------------------------------------------------------------------------
Living on earth is expensive, but it includes a free trip around the sun.
5 years, 2 months
ca-error 1: Invalid Credential
by Torsten Harenberg
Dear all,
we are running a pair of IPA servers.
Our master seems to run fine. It had some certificate expired, but we
could solve this by setting the time back, renewing all certificates and
getting him back to today.
Now the "slave" server has also some expired certificates:
[root@ipa ca]# getcert list |grep expires
expires: 2021-01-14 08:53:15 UTC
expires: 2019-01-29 08:07:57 UTC
expires: 2019-01-29 08:07:17 UTC
expires: 2035-03-19 07:41:20 UTC
expires: 2019-01-29 08:06:57 UTC
expires: 2020-08-09 11:55:16 UTC
expires: 2020-08-31 11:55:19 UTC
expires: 2020-08-31 11:55:38 UTC
[root@ipa ca]#
So we tried the same receipe and could update the first of those
certificates, but now starting the 2nd one, we got stuck.
ipa-cacert-manage renew
failes and also the other certificates cannot be updated with
Request ID '20170505060648':
status: MONITORING
ca-error: Server at
"https://ipa.pleiades.uni-wuppertal.de:8443/ca/agent/ca/profileProcess"
replied: 1: Invalid Credential.
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS
Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS
Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=PLEIADES.UNI-WUPPERTAL.DE
subject: CN=OCSP Subsystem,O=PLEIADES.UNI-WUPPERTAL.DE
expires: 2019-01-29 08:07:57 UTC
eku: id-kp-OCSPSigning
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
a
getcert resubmit -i 20170505060648
brings up the same error message soon after. In the logs we found:
/var/log/pki/pki-tomcat/ca/debug
[25/Jan/2019:10:12:24][http-bio-8443-exec-7]: CertUserDBAuthentication:
cannot map certificate to any user
[25/Jan/2019:10:12:24][http-bio-8443-exec-7]: SignedAuditEventFactory:
create() message created for eventType=AUTH_FAIL
/var/log/messages
Jan 25 10:12:24 ipa certmonger: 2019-01-25 10:12:24 [2829] Server at
"https://ipa.pleiades.uni-wuppertal.de:8443/ca/agent/ca/profileProcess"
replied: 1: Invalid Credential.
Any hint would be really appreciated.
Thanks a lot
Torsten
--
Dr. Torsten Harenberg harenberg(a)physik.uni-wuppertal.de
Bergische Universitaet
Fakultät 4 - Physik Tel.: +49 (0)202 439-3521
Gaussstr. 20 Fax : +49 (0)202 439-2811
42097 Wuppertal
5 years, 2 months
ipa-replica-install error - no-such-object ldap
by Arjen Heidinga
Dear all,
Perhaps someone could shed some light on what is amiss here. I am trying
to install a IPA replica to an ancient freeipa server, which has always
run standalone.
I have attached the logs for you to read. It seems there is missing
something in de ldap tree.
Server and replica-to-be are running Fedora 29, freeipa 4.7.2.
The (i suppose) relevant stacktrace is here:
2019-01-21T13:17:44Z DEBUG [28/41]: setting up initial replication
2019-01-21T13:17:45Z DEBUG retrieving schema for SchemaCache
url=ldapi://%2fvar%2frun%2fslapd-PLATYPUSNET-ORG.socket
conn=<ldap.ldapobject.SimpleLDAPObject object at 0x7f03f2114710>
2019-01-21T13:17:45Z DEBUG Destroyed connection
context.ldap2_139654961964256
2019-01-21T13:17:45Z DEBUG Starting external process
2019-01-21T13:17:45Z DEBUG args=['/bin/systemctl', '--system',
'daemon-reload']
2019-01-21T13:17:46Z DEBUG Process finished, return code=0
2019-01-21T13:17:46Z DEBUG stdout=
2019-01-21T13:17:46Z DEBUG stderr=
2019-01-21T13:17:46Z DEBUG Starting external process
2019-01-21T13:17:46Z DEBUG args=['/bin/systemctl', 'restart',
'dirsrv(a)PLATYPUSNET-ORG.service']
2019-01-21T13:17:51Z DEBUG Process finished, return code=0
2019-01-21T13:17:51Z DEBUG stdout=
2019-01-21T13:17:51Z DEBUG stderr=
2019-01-21T13:17:51Z DEBUG Restart of dirsrv(a)PLATYPUSNET-ORG.service
complete
2019-01-21T13:17:51Z DEBUG Created connection context.ldap2_139654961964256
2019-01-21T13:17:52Z DEBUG Fetching nsDS5ReplicaId from master [attempt 1/5]
2019-01-21T13:17:52Z DEBUG retrieving schema for SchemaCache
url=ldap://starkey.platypusnet.org:389
conn=<ldap.ldapobject.SimpleLDAPObject object at 0x7f03f28c7668>
2019-01-21T13:17:52Z DEBUG Successfully updated nsDS5ReplicaId.
2019-01-21T13:17:52Z DEBUG Add or update replica config
cn=replica,cn=dc\=platypusnet\,dc\=org,cn=mapping tree,cn=config
2019-01-21T13:17:52Z DEBUG Unhandled LDAPError: OPERATIONS_ERROR:
{'desc': 'Operations error'}
2019-01-21T13:17:52Z DEBUG Traceback (most recent call last):
File "/usr/lib/python3.7/site-packages/ipapython/ipaldap.py", line
1023, in error_handler
yield
File "/usr/lib/python3.7/site-packages/ipapython/ipaldap.py", line
1517, in find_entries
raise e
File "/usr/lib/python3.7/site-packages/ipapython/ipaldap.py", line
1477, in find_entries
result = self.conn.result3(id, 0)
File "/usr/lib64/python3.7/site-packages/ldap/ldapobject.py", line
749, in result3
resp_ctrl_classes=resp_ctrl_classes
File "/usr/lib64/python3.7/site-packages/ldap/ldapobject.py", line
756, in result4
ldap_result =
self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
File "/usr/lib64/python3.7/site-packages/ldap/ldapobject.py", line
329, in _ldap_call
reraise(exc_type, exc_value, exc_traceback)
File "/usr/lib64/python3.7/site-packages/ldap/compat.py", line 44, in
reraise
raise exc_value
File "/usr/lib64/python3.7/site-packages/ldap/ldapobject.py", line
313, in _ldap_call
result = func(*args,**kwargs)
ldap.NO_SUCH_OBJECT: {'desc': 'No such object'}
Kind Regards,
Arjen Heidinga
5 years, 2 months
light sub-cas crl / ocsp urls
by Natxo Asenjo
hi,
at work I am testing using a light sub-ca with openvpn to limit the scope
of hosts that can auto request a certificate.
So far so good, really impressed with how well it works.
The question I cannot answer is: are there specific urls for crl/ocsp for
sub-cas, or do the 'generic' crl/ocsp url apply to sub-cas as well?
Thanks for your support.
Regards,
--
Groeten,
natxo
5 years, 2 months