Re: Renewing a failed to auto-renewal certificate
by Stuart McRobert
Dear flo,
> there is only one certificate that failed to renew, and the repair
> should (hopefully) be straightforward.
>
> First of all, please confirm that the server is the CA renewal master:
> # ipa config-show | grep "CA renewal"
Although I can kinit on other hosts this fails on what I consider to be
our CA master.
kinit sm
kinit: Cannot contact any KDC for realm 'OUR_REALM' while getting initial credentials
and would normally work up until the expiry.
Now if I try from one of our clients
kinit works
ipa config-show | grep "CA renewal"
ipa: ERROR: cannot connect to 'https://PRIMARY_SERVER/ipa/json': [Errno 111]
Connection refused
which has happened since the expiry and web services etc being
unavailable which seems to make sense.
Attempt on one of the other freeipa servers, kinit works, but ipa command
fails with:
ipa: ERROR: cannot connect to 'https://THIS_SERVER/ipa/json':
(SEC_ERROR_EXPIRED_CERTIFICATE) Peer's Certificate has expired.
> The output should display your hostname. If that's not the case, we need
> more information (which host is CA renewal master, are all the certs
> valid on this host?)
What would you like me to gather next? I am being cautious as I don't
want the user service to fail, but worry not everything is working as it
should be.
Thanks.
Best wishes
Stuart
3 years, 7 months
Renewing a failed to auto-renewal certificate
by Stuart McRobert
Hi,
Although I thought these certificates would all happily auto-renew, and
auto-renew: yes is shown, one of them clearly hasn't with an obvious
impact on services. I recognise this is now a fairly old version of
freeipa.
As I don't wish to break anything further, what is the correct way to
safely and successfully renew this one certificate?
Thanks
Best wishes
Stuart
-------------------------------------------------------
ipa --version
VERSION: 4.4.4, API_VERSION: 2.215
getcert list | grep -i expi
expires: 2022-06-13 17:57:38 BST
expires: 2022-06-13 17:57:48 BST
expires: 2022-06-13 17:57:28 BST
expires: 2036-09-08 17:57:09 BST
expires: 2022-06-13 17:57:50 BST
expires: 2022-06-13 17:57:22 BST
expires: 2022-07-16 17:58:18 BST
expires: 2020-09-04 17:46:56 BST <<<<<<<<<<<<<<<<<<<<
I've changed strings to be OUR_DOMAIN and our_server below.
getcert list
Number of certificates and requests being tracked: 8.
Request ID '20170405152505':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=OUR_DOMAIN
subject: CN=CA Audit,O=OUR_DOMAIN
expires: 2022-06-13 17:57:38 BST
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20170405152506':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=OUR_DOMAIN
subject: CN=OCSP Subsystem,O=OUR_DOMAIN
expires: 2022-06-13 17:57:48 BST
eku: id-kp-OCSPSigning
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20170405152507':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=OUR_DOMAIN
subject: CN=CA Subsystem,O=OUR_DOMAIN
expires: 2022-06-13 17:57:28 BST
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20170405152508':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=OUR_DOMAIN
subject: CN=Certificate Authority,O=OUR_DOMAIN
expires: 2036-09-08 17:57:09 BST
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20170405152509':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=OUR_DOMAIN
subject: CN=IPA RA,O=OUR_DOMAIN
expires: 2022-06-13 17:57:50 BST
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Request ID '20170405152510':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-renew-agent
issuer: CN=Certificate Authority,O=OUR_DOMAIN
subject: CN=our_server,O=OUR_DOMAIN
expires: 2022-06-13 17:57:22 BST
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20170405152511':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-OUR_DOMAIN',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-OUR-DOMAIN/pwdfile.txt'
certificate: type=NSSDB,location='/etc/dirsrv/slapd-OUR_DOMAIN',nickname='Server-Cert',token='NSS Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=OUR_DOMAIN
subject: CN=our_server,O=OUR_DOMAIN
expires: 2022-07-16 17:58:18 BST
principal name: ldap/our_server@OUR_DOMAIN
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv OUR_DOMAIN
track: yes
auto-renew: yes
Request ID '20170405152512':
status: CA_UNREACHABLE
ca-error: Error setting up ccache for "host" service on client using default keytab: Cannot contact any KDC for requested realm.
stuck: no
key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=OUR_DOMAIN
subject: CN=our_server,O=OUR_DOMAIN
expires: 2020-09-04 17:46:56 BST <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
principal name: HTTP/our_server@OUR_DOMAIN
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_httpd
track: yes
auto-renew: yes
3 years, 7 months
Solaris 10 client setup. Works for user not groups
by Lois Blood Bennett
Hi! I am probably missing something really obvious.
I have an IPA server that is still in development. I have created two test clients that are clones of existing VMs. One is Centos 7.7 and the other is Solaris10. The Centos 7.7 one is working great. The Solaris one works now for getent passwd user and. for logging in but the groups command is returning the list from the old LDAP server and I can't figure out how it is getting that.
The content of the /var/ldap/ldap_client_file is :
root # cat ldap_client_file
#
# Do not edit this file manually; your changes will be lost.Please use ldapclient (1M) instead.
#
NS_LDAP_FILE_VERSION= 2.0
NS_LDAP_SERVERS= 172.27.104.187
NS_LDAP_SEARCH_BASEDN= dc=channing,dc=harvard,dc=edu
NS_LDAP_AUTH= tls:simple
NS_LDAP_SEARCH_SCOPE= sub
NS_LDAP_SERVER_PREF= chanidm.bwh.harvard.edu
NS_LDAP_CACHETTL= 0
NS_LDAP_CREDENTIAL_LEVEL= proxy
NS_LDAP_SERVICE_SEARCH_DESC= passwd:cn=users,cn=accounts,dc=channing,dc=harvard,dc=edu
NS_LDAP_SERVICE_SEARCH_DESC= group:cn=groups,cn=accounts,dc=channing,dc=harvard,dc=edu
NS_LDAP_ATTRIBUTEMAP= passwd:uidnumber=uidNumber
NS_LDAP_ATTRIBUTEMAP= group:memberuid=memberUid
NS_LDAP_ATTRIBUTEMAP= group:gidnumber=gidNumber
NS_LDAP_ATTRIBUTEMAP= passwd:gidnumber=gidNumber
NS_LDAP_OBJECTCLASSMAP= group:posixGroup=posixgroup
NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:tls:simple
NS_LDAP_SERVICE_AUTH_METHOD= passwd-cmd:tls:simple
Any suggestions?
Thank you all.
Lois Bennett, MSEE
Senior System Administrator
Channing Division of Network Medicine, Brigham & Women's Hospital
A Teaching Affiliate of Harvard Medical School and Harvard School of Public Health
3 years, 7 months
FreeIPA DNS (named-pkcs11) failover
by Peter Larsen
I have two FreeIPA servers both are working as DNS servers for the
network. Each IPA server is in the DNS server list, so they serve as
"backup" for one another. I had one of the server's named-pkcs11 fail
last night and somehow the second server failed resolving as it could
not reach the first one.
The zone they're hitting has forwarding disabled. I could get internal
addresses resolved but when it came to external, the server that was
running would not forward out of the network - only to the server that
no longer was open.
I'm struggling to see what would cause this dependency. Since the zone
definition is the same on both systems, what causes this dependency? Is
there a setting I need to look at that's not in the LDAP DB? Each IPA
server has a resolve that lists localhost (them-self) and the IP address
of the other IPA server. So I understand if there's attempt to reach
the other, but if the first IPA server can do a global forward, why
can't the other?
I use "forwarding disabled" because it turned out when there was no
external access the "forward first" would fail and hence I would have no
DNS just because my ISP decided not to reply - even the internal DNS
would fail this way. Forwarding disabled seems to work - and it's my
expectation that it simply looks up the NS record directly when it
doesn't have a zone that matches. So why does one of the IPA servers not
seem to be able to do this?
--
Regards
Peter Larsen
3 years, 7 months
migrate IPA server to new OS
by Boris Behrens
Hi,
just a short question:
Is it possible to migrate a freeIPA server to a new host?
I'd like to move from fedora 26 to centos8, but I wouldn't like to "add a
new master, then remove the older master, test everything, move ip
addresses and fw rules" and all that stuff.
Cheers
Boris
--
Die Selbsthilfegruppe "UTF-8-Probleme" trifft sich diesmal abweichend im
groüen Saal.
3 years, 7 months
FreeIPA Role Management
by John Burns
What exactly should be granted to enable a user to view /edit freeIPA roles?
Specifically, what enables a user to view anything under "IPA Server" > "Role-Based Access Control?"
Context: roles, privileges, permissions are all populated for one non-"admin" login but not for another.
3 years, 7 months
Delegation (S4U2Proxy) with apache's mod_auth_gssapi
by Aurelien Bompard
Hey folks!
I have a Kerberos issue when using s4u2proxy with mod_auth_gssapi and IPA, and I don't know where to look.
Basically, I've setup delegation in IPA (with servicedelegationrules and targets) and in Apache's config for mod_auth_gssapi, but the directory where the CCaches are supposed to be created remains empty (GssapiDelegCcacheDir).
In the apache log I only see:
GSS ERROR gss_acquire_cred[_from]() failed to get server creds: [Unspecified GSS failure. Minor code may provide more information ( SPNEGO cannot find mechanisms to negotiate)]
For context, the webapp running in Apache is delegating for IPA's ldap service, and if I contact it directly with ldapwhoami I get the right result, so it's really the delegation I think.
Also, the webapp is running in openshift, but that should not be a big issue (besides for debugging) because I've already made it work elsewhere.
I have keytabs for the host and the HTTP service:
$ klist -k /etc/krb5.keytab
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
1 host/fasjson.stg.fedoraproject.org(a)STG.FEDORAPROJECT.ORG
1 host/fasjson.stg.fedoraproject.org(a)STG.FEDORAPROJECT.ORG
$ klist -k /etc/keytabs/http
Keytab name: FILE:/etc/keytabs/http
KVNO Principal
---- --------------------------------------------------------------------------
1 HTTP/fasjson.stg.fedoraproject.org(a)STG.FEDORAPROJECT.ORG
1 HTTP/fasjson.stg.fedoraproject.org(a)STG.FEDORAPROJECT.ORG
And the section in Apache's config file is:
AuthType GSSAPI
AuthName "Kerberos Login"
GssapiUseSessions On
Session On
SessionCookieName ipa_session path=/;httponly;secure;
SessionHeader IPASESSION
GssapiSessionKey file:/httpdir/run/session.key
GssapiCredStore keytab:/etc/keytabs/httpd
GssapiImpersonate On
GssapiDelegCcacheDir /httpdir/run/ccaches
GssapiDelegCcachePerms mode:0660
GssapiUseS4U2Proxy on
GssapiAllowedMech krb5
Here's what I'm seeing. When I'm authenticated with kerberos:
$ klist
Ticket cache: KEYRING:persistent:1000290000:1000290000
Default principal: abompard(a)STG.FEDORAPROJECT.ORG
Valid starting Expires Service principal
09/02/20 12:55:59 09/03/20 12:55:47 krbtgt/STG.FEDORAPROJECT.ORG(a)STG.FEDORAPROJECT.ORG
and I contact the web app with curl: curl --negotiate -u : https://fasjson.stg.fedoraproject.org/v1/
I get a 401 response with the log pasted above. The /httpdir/run/ccaches/ directory remains empty, but I do get the service's entry in klist:
$ klist
Ticket cache: KEYRING:persistent:1000290000:1000290000
Default principal: abompard(a)STG.FEDORAPROJECT.ORG
Valid starting Expires Service principal
09/02/20 12:57:12 09/03/20 12:55:47 HTTP/fasjson.stg.fedoraproject.org(a)STG.FEDORAPROJECT.ORG
09/02/20 12:55:59 09/03/20 12:55:47 krbtgt/STG.FEDORAPROJECT.ORG(a)STG.FEDORAPROJECT.ORG
I don't know what I'm doing wrong and where I could dig. Could you point me in the right direction? I'm also on IRC in the freeipa channel as abompard.
Thanks!
Aurélien
3 years, 7 months
freeIPA : AD trust
by Christophe BERGER
I created a trust relationship between my IPA server, and an Active Directory.
From any machine connected to freeIPA, I can :
- sudo su - ADuser(a)ad.example.com
- id ADuser(a)ad.example.com ( I get things like uid=167644279(ADuser(a)ad.example.com) gid=167644279(ADuser(a)ad.example.com) groups=167644279(ADuser@ad.example.com),167616854(groupXXX(a)ad.example.com), ....................
- getent passwd ADuser(a)ad.example.com
ADuser@ad.example.com:*:167644279:167644279:ADuser:/home/example.com/ADuser
The connection between IPA and AD looks fine.
Then I created :
- An external group, with my ADuser(a)ad.example.com user (external)
- An POSIX group, with my external group as a user group member
- A HBAC rule to allow the POSIX group to connect to a server
However, I can't ssh this server with my AD account, I get this :
Sep 01 15:15:18 myServer.example.com systemd[1]: Starting SSSD Kerberos Cache Manager...
Sep 01 15:15:18 myServer.example.com systemd[1]: Started SSSD Kerberos Cache Manager.
Sep 01 15:15:18 myServer.example.com sssd[kcm][1730]: Starting up
Sep 01 15:15:18 myServer.example.com [sssd[krb5_child[1727]]][1727]: Cannot find KDC for realm "EXAMPLE.COM"
Sep 01 15:15:18 myServer.example.com [sssd[krb5_child[1727]]][1727]: Cannot find KDC for realm "EXAMPLE.COM"
Sep 01 15:15:18 myServer.example.com [sssd[krb5_child[1731]]][1731]: Cannot find KDC for realm "EXAMPLE.COM"
Sep 01 15:15:18 myServer.example.com [sssd[krb5_child[1731]]][1731]: Cannot find KDC for realm "EXAMPLE.COM"
Sep 01 15:15:18 myServer.example.com sshd[1723]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=X.X.X.X user=ADuser(a)EXAMPLE.COM
Sep 01 15:15:18 myServer.example.com sshd[1723]: pam_sss(sshd:auth): received for user ADuser(a)EXAMPLE.COM: 6 (Permission denied)
Sep 01 15:15:20 myServer.example.com sshd[1723]: Failed password for ADuser(a)EXAMPLE.COM from X.X.X.X port 57320 ssh2
3 years, 7 months