During replica setup I see the following:
[39/41]: activating sidgen plugin
[40/41]: activating extdom plugin
[41/41]: configuring directory to start on boot
Done configuring directory server (dirsrv).
Replica DNS records could not be added on master:
Insufficient access: Insufficient 'add' privilege to add the
Configuring Kerberos KDC (krb5kdc)
[1/5]: configuring KDC
and process progress till is completed okey.
Should that message warrant some post-setup investigation
and if yes then what? What to check and look for?
many thanks, L
I must be missing something I hope. This should just work,
$ ipa migrate-ds --bind-dn="cn=Directory Manager"
--group-objectclass=posixgroup --with-compat ldap://10.0.0.6
Prior to above, on the target IPA I run:
Source IPA is: VERSION: 4.6.8, API_VERSION: 2.237
Target is: VERSION: 4.8.7, API_VERSION: 2.239
$ smbclient -L //love.ccn.mine.domain -Ume
lp_load_ex: changing to config backend registry
Unknown parameter encountered: "includes"
Enter CCN\me's password:
session setup failed: NT_STATUS_INVALID_SID
Any suggestions as what is (not but should)happening are
many thanks, L.
* UI size limit set to 50
* nsslapd-sizelimit default of 2000
* 100 user objects in tree
If I run a paged query with -E pr=10/prompt against the main tree, I the results are paged as expected.
If I run a paged query with -E pr=10/prompt against the compat tree, both the client pr setting and the IPA size limit are ignored and the whole tree is returned.
Is this expected behaviour, or is something amiss?
I’ve been running a number of macs bound to FreeIPA for years now. The biggest nuisance is that I haven’t found a way to make home directory when one doesn’t exist.
Without a home directory, a users logs in, the beachball spins forever and the user never gets a desktop because there is no user home directory.
"createhomedir -c -a" functions (on most systems), but I’d rather not run this in cron.
Has anyone found the PAM secret to have this function like mkhomedir on a CentOS host?
grant@outhouse:~[20201213-6:51][#1003]$ authconfig --test | grep mkhome
pam_mkhomedir or pam_oddjob_mkhomedir is enabled (umask=0077)
I wish there were an authconfig on os-x
This e-mail and any attachments are intended only for use by the addressee(s) named herein and may contain confidential information. If you are not the intended recipient of this e-mail, you are hereby notified any dissemination, distribution or copying of this email and any attachments is strictly prohibited. If you receive this email in error, please immediately notify the sender by return email and permanently delete the original, any copy and any printout thereof. The integrity and security of e-mail cannot be guaranteed.
We boot everything stateless in our environment and are using FreeIPA for
authentication. I started discussing this a while ago but ended up with
other things taking priority. The number of machines we have make managing
keys an untenable solution so we are using
ipa-client-install -U -q -p <join user> -w <password --domain=domain.com
--server=ipaserver.domain.com --fixed-primary --force-join
called from rc.local during boot to rejoin machines to the FreeIPA
environment (we will be moving away from --fixed-primary but aren't there
yet). While this works it, potentially, exposes a password. I am looking
for a better way to handle machines that need to re-join at every boot.
We have access to ansible as well a decent, in house, templating system for
configuration. Please forgive my starting this discussion anew and not
resurrecting a zombie and thanks in advance for your help!
Senior Linux Administrator
I just upgraded copies of our 3 servers from Centos 8.2 to 8.3. I always try it on copies before doing it on the real thing.
The upgrades all went fine, but on one of the servers, the services weren’t running, and ipactl status complained
Failed to get list of services to probe status!
Configured hostname z does not match any master server in LDAP:
Adding prints to the python code, I found the issue was that the services, e.g.
when they should have had
It was easy to fix. Things now look OK.
Since I’ve fixed it, I don’t need any help, but I thought it was worth reporting. There were some oddities in getting the copies working. Initially I had bad IP addresses various places. That broke synchronization, and I had to reinitialize server z by copying from x. But that was before the upgrade. Before doing any upgrades I made sure everything worked, and the replicas were all syncing.
The fix did sync to the other servers.
The error message wasn’t entirely helpful.
Does anyone know what version of Ubuntu does support Freeipa server ? I have tried with 18.04 which fails always due to pki-tomcatd issues and Ubuntu 20 seems to not have the packages in the repository.
Any suggestion/help is appreciated.
When I browse to the webUI for IDM, I'm getting nothing.
The http error log is showing:
[Thu Dec 10 15:30:44.429646 2020] [wsgi:error] [pid 1773:tid 139794280646400] [remote 172.26.33.93:42908] ipa: INFO: [jsonserver_i18n_messages] UNKNOWN: i18n_messages(version='2.239'): SUCCESS
[Thu Dec 10 15:32:28.088766 2020] [wsgi:error] [pid 1773:tid 139794280646400] [remote 172.26.33.93:42932] ipa: INFO: [jsonserver_i18n_messages] UNKNOWN: i18n_messages(version='2.239'): SUCCESS
[Thu Dec 10 15:32:39.316974 2020] [wsgi:error] [pid 1773:tid 139794280646400] [remote 172.26.33.93:42932] ipa: INFO: [jsonserver_i18n_messages] UNKNOWN: i18n_messages(version='2.239'): SUCCESS
[Thu Dec 10 15:32:53.657573 2020] [wsgi:error] [pid 1774:tid 139794280646400] [remote 172.26.33.93:42932] ipa: INFO: [jsonserver_i18n_messages] UNKNOWN: i18n_messages(version='2.239'): SUCCESS
The http access log is more interesting:
172.26.33.93 - - [10/Dec/2020:15:32:53 +1100] "GET /ipa/ui/js/plugins/idoverride-memberof/idoverride-memberof.js?40807 HTTP/1.1" 404 19
When I go hunting, I see this:
[root@idm httpd]# ls -la /usr/share/ipa/ui/js/plugins/idoverride-memberof/
drwxr-xr-x. 2 root root 6 Dec 10 13:36 .
drwxr-xr-x. 3 root root 33 Oct 9 00:45 ..
I see there is a package available;
[root@idm httpd]# dnf info ipa-idoverride-memberof-plugin --all
Name : ipa-idoverride-memberof-plugin
Version : 0.0.4
Release : 6.module+el8+2555+b334d87b
Architecture : x86_64
Size : 31 k
Source : ipa-idoverride-memberof-0.0.4-6.module+el8+2555+b334d87b.src.rpm
But I see that it's already installed:
Package ipa-server-trust-ad-4.8.7-13.module+el8.3.0+8376+0bba7131.x86_64 is already installed.
I updated from RHEL 8.2 to 8.3 this AM. It was working last week with 8.2. Is there meant to be an idoverride-memberof.js file?