I've had a FreeIPA installation running without issues until today directory services went down and when I attempt to restart services using `ipactl restart` the kadmin service fails to start. I've been digging through logs and searching for answers but haven't found anything that makes sense to me. The only change I introduced (that I'm aware of) was that I upgraded ipa-server on the replica a week or two ago. Master is running IPA 4.5 and replica is running IPA 4.6.
Any help with troubleshooting would be greatly appreciated.
I've been following this post to refine an ldapsearch query in an attempt to return a list of AD users via IPA:
But haven't had luck yet. What I've tried so far:
LDAPTLS_CACERT=/etc/ipa/ca.crt ldapsearch -H ldaps://idmipa03.mws.mds.xyz:636 -D "uid=admin,cn=users,cn=accounts,dc=mws,dc=mds,dc=xyz" -w "<SECRET>" -b "dc=mws,dc=mds,dc=xyz" -v "(&(objectClass=posixAccount)(uid=*))" |grep dn:
[root@idmipa03 ~]# cat ad-lookup.update
[root@idmipa03 ~]# ipa-compat-manage status
Directory Manager password:
[root@idmipa03 ~]# ipa-ldap-updater ad-lookup.update
Update complete, no data were modified
The ipa-ldap-updater command was successful
Still I don't get a list of AD users. Did not use --enable-compat on installation of the IPA servers. What am I missing?
I know of one usage - all the IPA ansible modules (ipa_*) query for 'ipa-ca' record to find the IPA server.
But for other cases - looks like IPA clients mostly rely on entries like '_kerberos.*' and '_ldap.*'...
What other functionality uses 'ipa-ca' record?
I found out that running ipa on rhel8 in the file /etc/krb5.conf.d/freeipa
prevents ad domain account users from logging in to the ipa server running
according to this site it's protection against dictionary attacks
commenting those two lines and restarting the sssd service allows the ad
domain users to login to the rhel8 systems
however, this means I lose the extra protection against dictionary attacks.
Is there a way to have both ?
( login for ad users on rhel8 and dictionary attack protection )
sadly we had a power shortage (a transformer exploded in the building next
to us....) and all server shutted down immediately - i started them again.
now we have some strange errors:
First only two clients werent able to access their nfs home - two days
latter all clients cant access them...
I first check the date but it is synced all over the system and not the
then i discovered an error in the logs that the callback ip wasnt right,
fixed that too...
still cant get access to the nfs server - only the one share that is
accessiable for all users is mounted.
Keytabes was renewed on NFSserver as on the clients. the krb5 logs dont
show any real clue...
I use virtualized Centos Based Server (Up to Date):
I have managed to login to an IPA client with a non-existing user.
My AD user is z123456(a)addomain.mydomain.at and I have created a similar
user called i123456(a)ipadomain.mydomain.at. What happened now is that I
could log in with the i-User and what I get to see after logging in is this:
[email@example.com(a)as12314 ~]$ id
[firstname.lastname@example.org(a)as12314 ~]$ whoami
The user i123456(a)addomain.mydomain.at does NOT exist.
addomain is set as default domain in the client's sssd.conf.
What is wrong here? Are things just displayed wrong or could it be more?
Which files do you need in order to analyze this issue?