FreeIPA + Freeradius
by Alessandro Minonzio
Hi,
I'n new about FreeIPA ( v. 4.6.5 ) and I ask help about first configuration with FreeRadius on Centos 7.
I need documentation or suggestion about this implementation.
Could somone help me?
Thanks
Alessandro
2 years, 9 months
PermitEmptyPasswords and pam_setcred
by Ben Aveling
This is weird.
If /etc/sshd_config contains:
PermitEmptyPasswords yes
Then ssh to the host fails, sort of.
As soon as the ssh command executes, "authentication failure" appears in /var/log/secure
pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=test6f
But ssh doesn't get disconnected straight away.
First you get prompted for a password.
If you enter the correct password, then you get disconnected.
e.g.
$ ssh test6f@localhost
Password:
Write failed: Broken pipe
Aug 14 17:44:38 centos25 sshd[4505]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=test6f
Aug 14 17:44:38 centos25 sshd[4505]: pam_sss(sshd:auth): received for user test6f: 7 (Authentication failure)
Aug 14 17:44:51 centos25 sshd[4508]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=test6f
Aug 14 17:44:51 centos25 sshd[4505]: Accepted keyboard-interactive/pam for test6f from ::1 port 47542 ssh2
Aug 14 17:44:51 centos25 sshd[4505]: fatal: PAM: pam_setcred(): Failure setting user credentials
If you enter a wrong password three times (or no password at all), then the prompt changes, and if you now enter a password, it succeeds.
$ ssh test6f@localhost
Password:
Password:
Password:
test6f@localhost's password:
Last failed login: Fri Aug 14 17:32:00 AEST 2020 from localhost on ssh:notty
There were 3 failed login attempts since the last successful login.
Last login: Fri Aug 14 17:31:11 2020 from localhost
Aug 14 17:47:47 centos25 sshd[4516]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=test6f
Aug 14 17:47:47 centos25 sshd[4516]: pam_sss(sshd:auth): received for user test6f: 7 (Authentication failure)
Aug 14 17:47:48 centos25 sshd[4519]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=test6f
Aug 14 17:47:48 centos25 sshd[4519]: pam_sss(sshd:auth): received for user test6f: 7 (Authentication failure)
Aug 14 17:47:48 centos25 sshd[4516]: error: PAM: Authentication failure for test6f from localhost
Aug 14 17:47:49 centos25 sshd[4521]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=test6f
Aug 14 17:47:49 centos25 sshd[4521]: pam_sss(sshd:auth): received for user test6f: 7 (Authentication failure)
Aug 14 17:47:49 centos25 sshd[4516]: error: PAM: Authentication failure for test6f from localhost
Aug 14 17:47:49 centos25 sshd[4523]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=test6f
Aug 14 17:47:49 centos25 sshd[4523]: pam_sss(sshd:auth): received for user test6f: 7 (Authentication failure)
Aug 14 17:47:49 centos25 sshd[4516]: error: PAM: Authentication failure for test6f from localhost
Aug 14 17:47:49 centos25 sshd[4516]: Failed keyboard-interactive/pam for test6f from ::1 port 47555 ssh2
Aug 14 17:47:52 centos25 sshd[4516]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=test6f
Aug 14 17:47:52 centos25 sshd[4516]: Accepted password for test6f from ::1 port 47555 ssh2
Aug 14 17:47:52 centos25 sshd[4516]: pam_unix(sshd:session): session opened for user test6f by (uid=0)
This behaviour doesn't happen if ipa-client is not installed, or if it is uninstalled.
This behaviour seems to be the same for an IPA user or for a local user
This behaviour doesn't happen if PermitEmptyPasswords is no, which is the default, and a sensible default, and I don't know why anyone set it to something different, but they did, and this was the resulting behaviour, and I tell you, it took a bit of tracking down to work out what was happening.
Without knowing more about why this happens, or what it would take to change it, I'm not sure that this is a bug, or if it is a bug, if it is a but that is worth fixing. But I just thought I'd report it and let you decide if you want to do anything with it.
Regards, Ben
2 years, 9 months
Add User attributes into the shemas & UI
by Karim Bourenane
Hello Team
I want to know how easily I can add new attributes/objectclass into my
FreeIpa platform, version 4.6.4.
I see that I must create a new schema in ldif format beginning by
cn=config....
Thanks you for your help
Bien à vous / Regard
Mr Karim Bourenane
+33686464439
+32 493 86 63 54
2 years, 9 months
getcert status: CA_REJECTED
by Winfried de Heiden
Hi all,
For some reason, I messed up with several certificates in FreeIPA,
version: 4.8. One particular KRA cert seems problematic:
Request ID '20200820113800': status: CA_REJECTED ca-error:
Server at "<some server>:8080/ca/ee/ca/profileSubmit" replied: Missing
credential: sessionID stuck: yes key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='cert-
nickname=transportCert cert-pki-kra',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-
tomcat/alias',nickname='cert-nickname=transportCert cert-pki-
kra',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer:
subject: expires: unknown pre-save command:
/usr/libexec/ipa/certmonger/stop_pkicad post-save command:
/usr/libexec/ipa/certmonger/renew_ca_cert "transportCert cert-pki-kra"
track: yes auto-renew: yes
How to fix?
Winfried
2 years, 9 months
FreeIPA 4.8.9 released
by Alexander Bokovoy
The FreeIPA team would like to announce FreeIPA 4.8.9 release!
It can be downloaded from http://www.freeipa.org/page/Downloads. Builds
for Fedora distributions will be available from the official repository
soon.
== Highlights in 4.8.9
* 5011: [RFE] Forward CA requests to dogtag or helper by GSSAPI
* 7137: [RFE]: Able to browse different links from IPA web gui in new
tabs
* 8129: Tests: Replace paramiko with OpenSSH
Paramiko is not compatible with FIPS mode, therefore convert most
tests to using ssh directly. The only non-converted test is the
2-prompt OTP test because sshpass does not support 2-prompt password
authentication ( https://pagure.io/freeipa/issue/8431 ).
* 8151: test_commands timing-out
Re-enable test_sss_ssh_authorizedkeys ; add -v to ssh in order to
get debug information if this test fails or stalls again. The test
was run 16 times without a failure before re-enabling it.
* 8189: NIghtly test failure in test_integration/test_nfs.py::TestIpaClientAutomountFileRestore::test_nsswitch_backup_restore_sssd
Previously, ipa-client-installation saved the pre-install state
using "authselect current" command and the uninstallation reverted
to the same authselect state. In cases where the system was
installed using authconfig instead of authselect, the uninstallation
was unable to revert to the same state and picked "sssd"'s
authselect profile instead. Now, the client installation relies on
the backup functionality of authselect and is able to revert to the
exact pre-install state
* 8304: [fed32] client-install does not properly set
ChallengeResponseAuthentication yes in sshd conf
ipa-client-installation now writes the sshd configuration to the
drop-in directory /etc/ssh/sshd_config.d/, in the 04-ipa.conf
snippet, thus ensuring that the setting
"ChallengeResponseAuthentication yes" take precedence.
* 8335: [WebUI] manage IPA resources as a user from a trusted Active
Directory domain
When users from trusted Active Directory domains have permissions to
manage IPA resources, they can do so through a Web UI management
console.
* 8374: EPN does not ship its default configuration ( /etc/ipa/epn.conf) in freeipa-client-epn
EPN did not ship any configuration file. This was an oversight, but
the tool itself would work fine as it had sane defaults ; moreover,
the man page for the configuration file was present.
* 8391: Remove dnf workaround from test_epn.y
The new PR-CI images are cleaner and do not need the *epn* packages
to be uninstalled/reinstalled.
* 8401: Create platform definitions for freeipa-container
ipaplatform now provides container platform flavors for
freeipa/freeipa-container
* 8432: test failure in test_commands.py::TestIPACommand::test_login_wrong_password:
AssertionError
Sometimes test_login_wrong_password fails because the log window the
string message is searched in is too narrow. Broaden the window by
looking at the past 10 seconds.
* 8444: EPN: enhance input validation
Various input validation checks were added to EPN.
* 8445: EPN: '[Errno 111] Connection refused' when the SMTP is down
EPN now displays a proper message if the configured SMTP server
cannot be contacted.
* 8449: EPN: enhance CLI option tests
EPN: enhance existing tests for --dry-run, --from-nbdays and
--to-nbdays.
=== Enhancements
=== Known Issues
=== Bug fixes
FreeIPA 4.8.9 is a stabilization release for the features delivered as a
part of 4.8 version series.
There are more than 50 bug-fixes details of which can be seen in the
list of resolved tickets below.
== Upgrading
Upgrade instructions are available on Upgrade page.
== Feedback
Please provide comments, bugs and other feedback via the freeipa-users
mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...)
or #freeipa channel on Freenode.
== Resolved tickets
* https://pagure.io/freeipa/issue/5011[#5011]
(https://bugzilla.redhat.com/show_bug.cgi?id=1527185[rhbz#1527185])
[RFE] Forward CA requests to dogtag or helper by GSSAPI
* https://pagure.io/freeipa/issue/5628[#5628] webui: Unclear(UX) purpose
of OTP field in password reset form on login
* https://pagure.io/freeipa/issue/7137[#7137]
(https://bugzilla.redhat.com/show_bug.cgi?id=1484088[rhbz#1484088])
[RFE]: Able to browse different links from IPA web gui in new tabs
* https://pagure.io/freeipa/issue/8129[#8129] Tests: Replace paramiko
with OpenSSH
* https://pagure.io/freeipa/issue/8151[#8151] test_commands timing-out
* https://pagure.io/freeipa/issue/8189[#8189]
(https://bugzilla.redhat.com/show_bug.cgi?id=1810179[rhbz#1810179])
Nightly test failure in
test_integration/test_nfs.py::TestIpaClientAutomountFileRestore::test_nsswitch_backup_restore_sssd
* https://pagure.io/freeipa/issue/8300[#8300] Replace uglify-js with
python3-rjsmin
* https://pagure.io/freeipa/issue/8304[#8304] [fed32] client-install
does not properly set ChallengeResponseAuthentication yes in sshd conf
* https://pagure.io/freeipa/issue/8326[#8326] CVE-2020-10747
* https://pagure.io/freeipa/issue/8335[#8335] [WebUI] manage IPA
resources as a user from a trusted Active Directory domain
* https://pagure.io/freeipa/issue/8336[#8336] [WebUI] "User attributes
for SMB services" section always shown
* https://pagure.io/freeipa/issue/8364[#8364] Nightly test failure while
establishing trust: Cannot find specified domain or server name
* https://pagure.io/freeipa/issue/8366[#8366] CA-less replica deployment
fails with --setup-ca
* https://pagure.io/freeipa/issue/8367[#8367] IPA-EPN fails to build in
ONLY_CLIENT mode
* https://pagure.io/freeipa/issue/8368[#8368]
(https://bugzilla.redhat.com/show_bug.cgi?id=1846349[rhbz#1846349])
cannot issue certs with multiple IP addresses corresponding to different
hosts
* https://pagure.io/freeipa/issue/8369[#8369] cert_find returns "CA not
configured" in CA-less install
* https://pagure.io/freeipa/issue/8370[#8370] ipa-join does not set
nshardwareplatform and nsosversion
* https://pagure.io/freeipa/issue/8371[#8371] Nightly test failure
[testing_master_testing] in
test_integration/test_idviews.py::TestCertsInIDOverrides
* https://pagure.io/freeipa/issue/8372[#8372]
(https://bugzilla.redhat.com/show_bug.cgi?id=1849914[rhbz#1849914])
FreeIPA - Utilize 256-bit AJP connector passwords
* https://pagure.io/freeipa/issue/8374[#8374]
(https://bugzilla.redhat.com/show_bug.cgi?id=1847999[rhbz#1847999]) EPN
does not ship its default configuration ( /etc/ipa/epn.conf ) in
freeipa-client-epn
* https://pagure.io/freeipa/issue/8377[#8377] Nightly test failure
(timeout) in test_caless_TestReplicaInstall
* https://pagure.io/freeipa/issue/8379[#8379] Nightly test failure
[testing_master_pki] while installing CA replica
* https://pagure.io/freeipa/issue/8381[#8381] Nightly test failure in
test_webui/test_loginscreen.py::TestLoginScreen::test_login_view
* https://pagure.io/freeipa/issue/8384[#8384] Provide reliable way to
know if a server installation is complete
* https://pagure.io/freeipa/issue/8388[#8388] Make help() on plugins
more useful
* https://pagure.io/freeipa/issue/8391[#8391] Remove dnf workaround from
test_epn.py
* https://pagure.io/freeipa/issue/8395[#8395] selinux don't audit rules
deny fetching trust topology
* https://pagure.io/freeipa/issue/8396[#8396] [WebUI] Font type of
"Enabled" column in user search facet wrong
* https://pagure.io/freeipa/issue/8399[#8399] certmonger attempts to add
LWCA tracking requests on non-CA server.
* https://pagure.io/freeipa/issue/8400[#8400] sshd template file is
installed in a wrong (server) location while used by the client side
* https://pagure.io/freeipa/issue/8401[#8401] Create platform
definitions for freeipa-container
* https://pagure.io/freeipa/issue/8403[#8403] Add option to add ipaapi
user as an allowed uid for ifp in /etc/sssd/sssd.conf when running
ipa-replica-install
* https://pagure.io/freeipa/issue/8407[#8407] Support changelog
integrated into main database
* https://pagure.io/freeipa/issue/8412[#8412]
(https://bugzilla.redhat.com/show_bug.cgi?id=1857157[rhbz#1857157]) AVC:
httpd cannot connect to ipa-custodia.sock
* https://pagure.io/freeipa/issue/8413[#8413] Nightly test failure in
test_integration/test_replica_promotion.py::TestUnprivilegedUserPermissions::test_sssd_config_allows_ipaapi_access_to_ifp
* https://pagure.io/freeipa/issue/8414[#8414] Nightly test failure in
test_integration/test_replica_promotion.py::TestReplicaPromotionLevel1::test_sssd_config_allows_ipaapi_access_to_ifp
* https://pagure.io/freeipa/issue/8416[#8416] [WebUI] Error while adding
user ID overrides to group
* https://pagure.io/freeipa/issue/8419[#8419] Azure is reporting a slew
of new no-member lint errors
* https://pagure.io/freeipa/issue/8425[#8425] Nightly test failure in
test_cert.test_cert.TestInstallMasterClient (certmonger timeout)
* https://pagure.io/freeipa/issue/8428[#8428] [ipatests] fails due to
new python-cryptography 3.0
* https://pagure.io/freeipa/issue/8429[#8429] Add fips-mode-setup to
ipaplatform.paths
* https://pagure.io/freeipa/issue/8432[#8432] test failure in
test_commands.py::TestIPACommand::test_login_wrong_password:
AssertionError
* https://pagure.io/freeipa/issue/8435[#8435] [ipatests] failures due to
new Pytest6.0 (pypi part)
* https://pagure.io/freeipa/issue/8437[#8437] unit tests for
ipa-extdom-extop are failing in Fedora 33
* https://pagure.io/freeipa/issue/8439[#8439] Nightly test failure in
test_integration/test_ipahealthcheck.py::TestIpaHealthCheck::test_ipa_healthcheck_expiring
* https://pagure.io/freeipa/issue/8440[#8440]
(https://bugzilla.redhat.com/show_bug.cgi?id=1863616[rhbz#1863616])
CA-less install does not set required permissions on KDC certificate
* https://pagure.io/freeipa/issue/8441[#8441]
(https://bugzilla.redhat.com/show_bug.cgi?id=1870202[rhbz#1870202]) File
permissions of /etc/ipa/ca.crt differ between CA-ful and CA-less
* https://pagure.io/freeipa/issue/8442[#8442] [pylint] warnings/errors
against pylint 2.5.3
* https://pagure.io/freeipa/issue/8444[#8444]
(https://bugzilla.redhat.com/show_bug.cgi?id=1866291[rhbz#1866291]) EPN:
enhance input validation
* https://pagure.io/freeipa/issue/8445[#8445]
(https://bugzilla.redhat.com/show_bug.cgi?id=1863079[rhbz#1863079]) EPN:
'[Errno 111] Connection refused' when the SMTP is down
* https://pagure.io/freeipa/issue/8447[#8447] Nightly test failure in
test_integration/test_ipahealthcheck/TestIpaHealthCheckWithoutDNS
* https://pagure.io/freeipa/issue/8449[#8449]
(https://bugzilla.redhat.com/show_bug.cgi?id=1866291[rhbz#1866291]) EPN:
enhance CLI option tests
* https://pagure.io/freeipa/issue/8456[#8456] Need new aci's for the new
replication changelog entries
* https://pagure.io/freeipa/issue/8459[#8459] [upgrade] handle missing
openssh-clients
* https://pagure.io/freeipa/issue/8461[#8461] [ALTLinux] server
uninstall error on missing /var/lib/samba
* https://pagure.io/freeipa/issue/8463[#8463] Nightly test failure in
test_ipahealthcheck.py::TestIpaHealthCheck::test_ipa_healthcheck_expiring
* https://pagure.io/freeipa/issue/8464[#8464] Increase replication
changelog trimming interval
== Detailed changelog since 4.8.8
Detailed changelog is available at https://www.freeipa.org/page/Releases/4.8.9#Detailed_changelog_since_4.8.8
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
2 years, 9 months
Installation with external CA - signed cert 'Not a CA'
by John Spooner
Hello,
I have been tasked with installing FreeIPA in our environment to help manage certificates for Postgres, NGINX and RabbitMQ. I am completely new to the administrative side of certificates, so I may have made some incorrect assumptions. We have decided to use LetsEncrypt as our external CA, so I ran the FreeIPA install:
sudo ipa-server-install --realm MYDOMAIN.COM --domain mydomain.com --setup-dns --auto-forwarders --allow-zone-overlap --external-ca --ca-subject "CN=mydomain.com"
This produced a CSR which I have had signed by LetsEncrypt (I also tried to sign the CSR with with gethttpsforfree, but got the same results):
sudo certbot --csr /root/ipa.csr --preferred-challenges dns certonly
As I understand it, it should be as simple at this point to rerun ipa-server-install with external-cert-file arguments for the signed CSR file and the existing trust chain.
sudo ipa-server-install --external-cert-file=/path/to/file/signed_csr.pem --external-cert-file=/etc/letsencrypt/live/mydomain.com/fullchain.pem
This results in an error I can't wrap my head around:
ERROR: CA Certificate CN=mydomain.com in <signed CSR file>, <trust chain file> is not valid: not a CA certificate.
After getting this certificate chain in FreeIPA I plan on creating a couple more layers of intermediate certificates and, eventually, create root certificates for the individual services. What assumption am I making that is causing this process to go sideways? I could not really find anything in the volumes of documentation I have gone through so far.
2 years, 9 months
[ipa_pam_access_handler_done] (0x0020): No HBAC rules find, denying access
by David McDaniel
Joined new ipa-client
RHEL 7.8
IPA VERSION: 4.6.6
Have many ipa joined hosts on same vers, using same sssd.conf/krb5.conf configs and member of same HBAC group associated with same HBAC rule with no issues; only this one host
Same issue for both IPA & AD users for this host
id & getent will pull IPA & AD users group memberships without issue from said host
Kinit works for IPA & AD users without issue from said host
Testing with `ipa hbactest` outputs desired results for sshd & login services for this host
SSH is a no go for both IPA & AD users, with the below logged each time an SSH attempt is made.
[sssd[be[ipa.domain.com]]] [sdap_account_expired_rhds] (0x0400): Performing RHDS access check for user [ad-user(a)example.com]
[sssd[be[ipa.domain.com]]] [sdap_account_expired_rhds] (0x4000): Account for user [ad-user(a)example.com] is not locked.
[sssd[be[ipa.domain.com]]] [sdap_account_expired] (0x0400): IPA access control succeeded, checking AD access control
[sssd[be[ipa.domain.com]]] [sdap_account_expired_ad] (0x0400): Performing AD access check for user [ad-user(a)example.com]
[sssd[be[ipa.domain.com]]] [sdap_account_expired_ad] (0x4000): User account control for user [ad-user(a)example.com] is [200].
[sssd[be[ipa.domain.com]]] [sdap_account_expired_ad] (0x4000): Expiration time for user [ad-user(a)example.com] is [9223372036854775807].
[sssd[be[ipa.domain.com]]] [ipa_fetch_hbac_send] (0x4000): Connection status is [online].
[sssd[be[ipa.domain.com]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection
[sssd[be[ipa.domain.com]]] [sdap_print_server] (0x2000): Searching <freeipa-master-ip-address>:389
[sssd[be[ipa.domain.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaHost)(fqdn=freeipa-client.ipa.domain.com))][cn=accounts,dc=ipa,dc=domain,dc=com].
[sssd[be[ipa.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
[sssd[be[ipa.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [cn]
[sssd[be[ipa.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [fqdn]
[sssd[be[ipa.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [serverHostname]
[sssd[be[ipa.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf]
[sssd[be[ipa.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [ipaSshPubKey]
[sssd[be[ipa.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [ipaUniqueID]
[sssd[be[ipa.domain.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 14
[sssd[be[ipa.domain.com]]] [sdap_op_add] (0x2000): New operation 14 timeout 60
[sssd[be[ipa.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55fcd97b0b90], connected[1], ops[0x55fcd979c7e0], ldap[0x55fcd9781e30]
[sssd[be[ipa.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
[sssd[be[ipa.domain.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
[sssd[be[ipa.domain.com]]] [sdap_get_generic_op_finished] (0x2000): Total count [0]
[sssd[be[ipa.domain.com]]] [sdap_op_destructor] (0x2000): Operation 14 finished
[sssd[be[ipa.domain.com]]] [sdap_id_op_done] (0x4000): releasing operation connection
[sssd[be[ipa.domain.com]]] [ipa_pam_access_handler_done] (0x0020): No HBAC rules find, denying access
[sssd[be[ipa.domain.com]]] [dp_req_done] (0x0400): DP Request [PAM Account #11]: Request handler finished [0]: Success
[sssd[be[ipa.domain.com]]] [_dp_req_recv] (0x0400): DP Request [PAM Account #11]: Receiving request data.
[sssd[be[ipa.domain.com]]] [dp_req_destructor] (0x0400): DP Request [PAM Account #11]: Request removed.
[sssd[be[ipa.domain.com]]] [dp_req_destructor] (0x0400): Number of active DP request: 0
[sssd[be[ipa.domain.com]]] [dp_pam_reply] (0x1000): DP Request [PAM Account #11]: Sending result [6][example.com]
[sssd[be[ipa.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55fcd97b0b90], connected[1], ops[(nil)], ldap[0x55fcd9781e30]
[sssd[be[ipa.domain.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list
sshd[2750]: pam_sss(sshd:account): Access denied for user ad-user(a)example.com: 6 (Permission denied)
$ ipa hbactest
User name: ad-user(a)example.com
Target host: freeipa-client.ipa.domain.com
Service: sshd
--------------------
Access granted: True
--------------------
Matched rules: allow_admin_all
Any help is much appreciated...stuck
2 years, 9 months
Re: pki-tomcatd not starting
by Scott Z.
... and just to show that I am a man of my word...
[cid:e4d4f3fa-c56a-4e3a-b5af-12ed7a7d90ab]
Thanks again for all the help guys!
Scott
________________________________
From: Scott Z. <sudz28(a)hotmail.com>
Sent: Thursday, August 13, 2020 9:58 AM
To: Fraser Tweedale <ftweedal(a)redhat.com>; FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
Cc: Rob Crittenden <rcritten(a)redhat.com>; Florence Blanc-Renaud <flo(a)redhat.com>; Alexander Scheel <ascheel(a)redhat.com>
Subject: Re: [Freeipa-users] Re: pki-tomcatd not starting
Taking it from the top again this morning 🙂
1) Stopped NTPD
2) Checked status of certmonger (running, several "Error 60 connecting to <server>: Peer certificate cannot be authenticated with given CA certificates)
3) Checked that debug.level=0 in CS.cfg (it was already set there)
4) Checked the 'not after' dates for auditSigningCert, ocspSigningCert, subsystemSigningCert, and Server-Cert... all are still valid except for Server-Cert (Not After Sep. 26 2019), so I set the system date back to Sept. 25, 2019.
5) Stopped all ipa services (ipactl stop)
6) Restated IPA services manually in the specified order (dirsrv@domain, krb5kdc, kadmin, named-pkcs11, httpd, pki-tomcatd@pki-tomcat)
7) Checked the status of all those services to make sure they were showing the new, older date of Sept. 25, 2019.
8) Ran the curl command to make sure it would work (curl --cacert /etc/ipa/ca.crt -v https://`hostname`:8443/ca/ee/ca/getCertChain)
9) Ran "ipa-getcert resubmi -i <reqID>" for the Server-Cert cert-pki-ca cert I was trying to renew.
10) Ran "getcert list" a couple of times; first saw that it was showing "SUBMITTING", the it switched after several seconds to "POST_SAVED_CERT" - WOW!!! SOMETHING NEW! Then, a few seconds later still, it's showing as "MONITORING". Checking the "expires" date, it's FINALLY updated to Sept. 14, 2021!!!!!!
I cannot tell you how exciting this is for me. What a journey. Now, I assume I just need to "ipactl stop" and then "ipactl start", and all should be well I guess. I'm afraid to do it though, I'm scared of the cert reverting or something funky 🙁
________________________________
From: Fraser Tweedale <ftweedal(a)redhat.com>
Sent: Wednesday, August 12, 2020 6:02 PM
To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
Cc: Rob Crittenden <rcritten(a)redhat.com>; Florence Blanc-Renaud <flo(a)redhat.com>; Alexander Scheel <ascheel(a)redhat.com>; Scott Z. <sudz28(a)hotmail.com>
Subject: Re: [Freeipa-users] Re: pki-tomcatd not starting
On Thu, Aug 13, 2020 at 02:43:33AM +0000, Scott Z. via FreeIPA-users wrote:
> Just in case it helps to narrow things down a bit or answers questions...
> 1) The problem IdM server is the CA Master as far as I can tell (ran the command "ipa config-show", saw that the IPA CA renewal master: was the same server with the bad cert.
>
In any case, the CA renewal master setting shouldn't affect renewal
of the Dogtag "Server-Cert cert-pki-ca" certificate. This is
because the TLS server certificates are not shared; each server
needs their own certificate.
> 2) Followed the steps in the Red Hat knowledge article at https://access.redhat.com/solutions/3357261
> 3) As noted at the bottom of that page, I had pretty good success up until the end.
>
> My current status is that I've done an ipactl restart --ignore-service-failure, my timedate value is once again current, and when I do a "getcert list" I see the offending cert (Server-Cert cert-pki-ca) listed as CA_UNREACHABLE, with a ca-error value of Internal Error and of course still showing an expiration date of Sep. 26, 2019.
>
> If I do a status check on the certmonger service I see lots of "Internal Error" messages along with "Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm '<domain>'."
>
Was the KDC running at the time those certmonger GSS errors were
produced? That could explain this error.
It would help to see the /etc/pki/pki-tomcat/ca/debug log:
- for the startup failures, that may indicate why Dogtag does not
start up properly
- and for the time period during which renewal of the problematic
certificate is attempted
Ensure PKI debug logging is at a verbose level. In
/etc/pki/pki-tomcat/ca/CS.cfg, change the config:
debug.level=0
It is counterintuitive but /lower/ number = higher verbosity.
It would help to see certmonger journal output (`journalctl -u
certmonger') covering the time period of the renewal attempt.
Also, just seeing the all the certificates in the various location
(especially Dogtag and dirsrv NSSDBs, including the CA certificates)
would be helpful.
I understand that you have security policies that may prevent you
share all this in a public list (or making extra work for you to
redact sensitive data). If it would allow you to share more
logs/data, perhaps you could consider a commercial support
subscription with Red Hat.
Thanks,
Fraser
2 years, 9 months