chronyd support in freeipa server?
by Kent Brodie
I have found online docs proposing chronyd support for freeipa (target 4.7).
I am running 4.8. Does support for using chronyd instead of ntpd exist yet? I have not founnd anything concrete yet to confirm this.
IF this exists, is there a documented procedure to change?
and if the support does not exist yet, does anyone have an insight as to when that might happen?
Thank you all in advance.
1 hour, 3 minutes
chronyd support in freeipa server?
by Kent Brodie
I have found online docs proposing chronyd support for freeipa (target 4.7).
I am running 4.8. Does support for using chronyd instead of ntpd exist yet? I have not founnd anything concrete yet to confirm this.
IF this exists, is there a documented procedure to change?
and if the support does not exist yet, does anyone have an insight as to when that might happen?
Thank you all in advance.
1 hour, 3 minutes
FreeIPA topology issues after clean install
by Am Titan
HI,
I am facing a repeated phenomenon, I have installed one FreeIPA server and two replica FreeIPA servers.
All are masters (roles are being assigned automatically).
The problem i experience directly after fresh install is that the topology keep breaks or at least "disconnected" after left the servers off for few hours.
The is literally no data on the servers and no changes are being made, first everything works ok, i even check the sync and all is working and syncing well, only after few hours that the serves are up again, the issues starts show up, here hare some paste from the servers:
[root@ipa-server1 ~]# ipa topologysuffix-verify domain
========================================================
Replication topology of suffix "domain" contains errors.
========================================================
------------------------
Topology is disconnected
------------------------
Server ipa-server1.ipa.example.com can't contact servers: ipa-server3.ipa.example.com
Server ipa-dctrlv2.ipa.example.com can't contact servers: ipa-server3.ipa.example.com
[root@ipa-server1 ~]# reboot
Last login: Wed Jan 20 16:17:02 2021 from 192.168.2.100
[root@ipa-server1 ~]# ipa topologysuffix-show # display all managed hosts and segments
Suffix name: all
ipa: ERROR: all: suffix not found
[root@ipa-server1 ~]# ipa topologysuffix-verify # check connectivity, missing connections, redundant connections
Suffix name: dc=int,dc=example,dc=com
ipa: ERROR: dc=int,dc=example,dc=com: suffix not found
[root@ipa-server1 ~]# ipa topologysuffix-verify # check connectivity, missing connections, redundant connections
Suffix name: domain
========================================================
Replication topology of suffix "domain" contains errors.
========================================================
------------------------
Topology is disconnected
------------------------
Server ipa-server1.ipa.example.com can't contact servers: ipa-server3.ipa.example.com
Server ipa-dctrlv2.ipa.example.com can't contact servers: ipa-server3.ipa.example.com
[root@ipa-server1 ~]# ipa topologysegment-find domain
Replication topology of suffix "domain" is in order.
====================================================
[root@ipa-server3 ~]# ipa-replica-manage re-initialize --from ipa-dctrlv2.ipa.example.com
'ipa-server3.ipa.example.com' has no replication agreement for 'ipa-dctrlv2.ipa.example.com'
[root@ipa-server3 ~]# ipa topologysegment-find
Suffix name: domain
------------------
2 segments matched
------------------
Segment name: ipa-server1.ipa.example.com-to-ipa-dctrlv2.ipa.example.com
Left node: ipa-server1.ipa.example.com
Right node: ipa-dctrlv2.ipa.example.com
Connectivity: both
Segment name: ipa-server1.ipa.example.com-to-ipa-server3.ipa.example.com
Left node: ipa-server1.ipa.example.com
Right node: ipa-server3.ipa.example.com
Connectivity: both
----------------------------
Number of entries returned 2
----------------------------
[root@ipa-server3 ~]# ipa topologysegment-find^C
[root@ipa-server3 ~]# pa topologysegment-del
-bash: pa: command not found
[root@ipa-server3 ~]# ipa topologysegment-del
Suffix name: domain
Segment name: ipa-server1.ipa.example.com-to-ipa-server3.ipa.example.com
ipa: ERROR: Server is unwilling to perform: Removal of Segment disconnects topology.Deletion not allowed.
[root@ipa-server3 ~]# ipa topologysegment-add ipa-server1.ipa.example.com-to-ipa-server3.ipa.example.com
Left node: ipa-server1.ipa.example.com
Right node: ipa-server3.ipa.example.com
Segment name [ipa-server1.ipa.example.com-to-ipa-server3.ipa.example.com]:
ipa: ERROR: invalid 'leftnode': left node (ipa-server1.ipa.example.com) does not support suffix 'ipa-server1.ipa.example.com-to-ipa-server3.ipa.example.com'
[root@ipa-server3 ~]# Last login: Sat Jan 16 18:11:10 2021 from 192.168.2.100
[root@ipa-server3 ~]#
Can someone please help understand why new installed servers with clean topology and no changes are breaking after few hours?
Thanks on advance
3 hours, 31 minutes
Login failed due to an unknown reason.
by anilkumar panditi
Hi,
I am running freeipa as a docker container and all of sudden i am getting
an error message while trying to login into free ipa server via web ui.
Login failed due to an unknown reason.
Tried checking for solution as , chmod a+x /var/lib/krb5kdc
But i dont see krb5kdc under /var/lib
Please help.
4 hours, 12 minutes
Let's encrypt SSL changed Intermediate
by Petar Kozić
Hi,
I had Let’s encrypt SSL on my freeipa server. When I setup freeIPA for the first time, I set Let’s encrypt on next way:
I installed DST CA ROOT and LetsEncrypt intermediate with next command:
ipa-cacert-manage -n DSTRootCAX3 -t C,, install DTSRootCAX3.pem
ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer
ipa-certupdate -v
Then, I issued letsencypt ssl for domain with certbot and make pkcs chain with command:
openssl pkcs12 -export -in my_domain.cer -inkey my.key.key -out my_ipa.p12 -certfile fullchain.cer
and install with command:
ipa-server-certinstall -w ipa.soholab.org.p12
In the last almost two years I didn’t have any problem, letsencrypt was renewed and freeipa was worked. But after last renew sll failed.
In the freeipa gui when I try to access to Authentication tab I get error:
cannot connect to 'https://my_domain:443/ca/rest/certs/search?size=2147483647': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:727)
I checked SSL in browser and I can see Let’s encrypt changed intermediate from Let’s encypt Authority X3 to R3.
I found doc on letsencypt where they said about that intermediate changes:
https://letsencrypt.org/2020/09/17/new-root-and-intermediates.html <https://letsencrypt.org/2020/09/17/new-root-and-intermediates.html>
I tried to install new Intermediate with this new R3 on same way as I do that earlier with old intermediate:
ipa-cacert-manage -n R3 -t C,, install new_intermediate.cer
but without luck.
Maybe someone of you had same probem, or some idea how to solve this?
Thank you in advanced.
8 hours, 17 minutes
FreeIPA centos8 update Failed to authenticate to CA REST API
by Ian Willis
Hi All,
I've been using freeipa configured as a HA pair on Centos for about 12
months and I've been really impressed, however this morning it has
started pumping mud. Any suggestions appreciated.
I did a dnf update of the server which appears to have broken the
FreeIPA server and I see the following errors from the ipa start
ipactl start
IPA version error: data needs to be upgraded (expected version '4.8.7-
13.module_el8.3.0+606+1e8766d7', current version '4.8.7-
12.module_el8.3.0+511+8a502f20')
Automatically running upgrade, for details see /var/log/ipaupgrade.log
...
[Disabling cert publishing]
[Ensuring CA is using LDAPProfileSubsystem]
[Migrating certificate profiles to LDAP]
IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run
command ipa-server-upgrade manually.
Unexpected error - see /var/log/ipaupgrade.log for details:
RemoteRetrieveError: Failed to authenticate to CA REST API
The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for
more information
Some information
The broken system.
CentOS Linux release 8.3.2011
ipa-server-4.8.7-13 (the updated server)
The still operational system
CentOS Linux release 8.3.2011
ipa-server-4.8.7-12
The certificate information based upon the following commands appear to
be good.
getcert list -f /var/lib/ipa/ra-agent.pem | grep expires
expires: 2021-12-17 14:43:54 AEDT
ldapsearch -D "cn=directory manager" -W -b o=ipaca "(uid=ipara)"
openssl x509 -text -in /var/lib/ipa/ra-agent.pem
From the /var/log/ipaupgrade.log
2021-01-12T09:51:07Z DEBUG request GET
https://groats.ipa.bogus.com.au:8443/ca/rest/account/login
2021-01-12T09:51:07Z DEBUG request body ''
2021-01-12T09:51:07Z DEBUG response status 500
2021-01-12T09:51:07Z DEBUG response headers Content-Type:
text/html;charset=utf-8
From the ca debug logs /var/log/pki/pki-tomcat/ca/debug.2021-01-12.log
I'm not sure if the following are relevant
2021-01-12 20:50:49 [main] FINEST: Getting
log.instance.SignedAudit.events=ACCESS_SESSION_ESTABLISH,ACCESS_SESSION
_TERMINATED,AUTH,AUTHORITY_CONFIG,AUTHZ,CERT_PROFILE_APPROVAL,CERT_REQU
EST_PROCESSED,CERT_SIGNING_INFO,CERT_STATUS_CHANGE_REQUEST_PROCESSED,CL
IENT_ACCESS_SESSION_ESTABLISH,CLIENT_ACCESS_SESSION_TERMINATED,CMC_REQU
EST_RECEIVED,CMC_RESPONSE_SENT,CMC_SIGNED_REQUEST_SIG_VERIFY,CMC_USER_S
IGNED_REQUEST_SIG_VERIFY,CONFIG_ACL,CONFIG_AUTH,CONFIG_CERT_PROFILE,CON
FIG_CRL_PROFILE,CONFIG_DRM,CONFIG_ENCRYPTION,CONFIG_OCSP_PROFILE,CONFIG
_ROLE,CONFIG_SERIAL_NUMBER,CONFIG_SIGNED_AUDIT,CONFIG_TRUSTED_PUBLIC_KE
Y,CRL_SIGNING_INFO,DELTA_CRL_GENERATION,FULL_CRL_GENERATION,LOG_PATH_CH
ANGE,OCSP_GENERATION,OCSP_SIGNING_INFO,PROFILE_CERT_REQUEST,PROOF_OF_PO
SSESSION,RANDOM_GENERATION,ROLE_ASSUME,SECURITY_DOMAIN_UPDATE,SELFTESTS
_EXECUTION
2021-01-12 20:50:49 [main] FINEST: Getting
log.instance.SignedAudit.events=ACCESS_SESSION_ESTABLISH,ACCESS_SESSION
_TERMINATED,AUTH,AUTHORITY_CONFIG,AUTHZ,CERT_PROFILE_APPROVAL,CERT_REQU
EST_PROCESSED,CERT_SIGNING_INFO,CERT_STATUS_CHANGE_REQUEST_PROCESSED,CL
IENT_ACCESS_SESSION_ESTABLISH,CLIENT_ACCESS_SESSION_TERMINATED,CMC_REQU
EST_RECEIVED,CMC_RESPONSE_SENT,CMC_SIGNED_REQUEST_SIG_VERIFY,CMC_USER_S
IGNED_REQUEST_SIG_VERIFY,CONFIG_ACL,CONFIG_AUTH,CONFIG_CERT_PROFILE,CON
FIG_CRL_PROFILE,CONFIG_DRM,CONFIG_ENCRYPTION,CONFIG_OCSP_PROFILE,CONFIG
_ROLE,CONFIG_SERIAL_NUMBER,CONFIG_SIGNED_AUDIT,CONFIG_TRUSTED_PUBLIC_KE
Y,CRL_SIGNING_INFO,DELTA_CRL_GENERATION,FULL_CRL_GENERATION,LOG_PATH_CH
ANGE,OCSP_GENERATION,OCSP_SIGNING_INFO,PROFILE_CERT_REQUEST,PROOF_OF_PO
SSESSION,RANDOM_GENERATION,ROLE_ASSUME,SECURITY_DOMAIN_UPDATE,SELFTESTS
_EXECUTION
2021-01-12 20:50:49 [main] FINE: Event filters:
2021-01-12 20:50:49 [main] FINE: - CMC_SIGNED_REQUEST_SIG_VERIFY:
(Outcome=Failure)
2021-01-12 20:50:49 [main] FINE: - CMC_USER_SIGNED_REQUEST_SIG_VERIFY:
(Outcome=Failure)
2021-01-12 20:50:49 [main] FINE: - DELTA_CRL_GENERATION:
(Outcome=Failure)
2021-01-12 20:50:49 [main] FINE: - FULL_CRL_GENERATION:
(Outcome=Failure)
2021-01-12 20:50:49 [main] FINE: - OCSP_GENERATION: (Outcome=Failure)
2021-01-12 20:50:49 [main] FINE: - RANDOM_GENERATION: (Outcome=Failure)
2021-01-12 20:50:49 [main] FINE: - SELFTESTS_EXECUTION:
(Outcome=Failure)
2021-01-12 20:50:49 [main] FINEST: Property
log.instance.SignedAudit.trace not found
However where it dies is
2021-01-12 20:50:50 [main] FINEST: Property internaldb.doCloning not
found
2021-01-12 20:50:50 [main] FINEST: Getting internaldb.doCloning=true
2021-01-12 20:50:50 [main] FINE: LdapBoundConnFactory: doCloning: true
2021-01-12 20:50:50 [main] FINE: LdapBoundConnFactory: mininum: 3
2021-01-12 20:50:50 [main] FINE: LdapBoundConnFactory: maximum: 15
2021-01-12 20:50:50 [main] FINE: LdapBoundConnFactory: host:
oats.ipa.amnesium.com.au
2021-01-12 20:50:50 [main] FINE: LdapBoundConnFactory: port: 636
2021-01-12 20:50:50 [main] FINE: LdapBoundConnFactory: secure: true
2021-01-12 20:50:50 [main] FINE: LdapBoundConnFactory: authentication:
2
2021-01-12 20:50:50 [main] FINE: LdapBoundConnFactory:
makeConnection(true)
2021-01-12 20:50:50 [main] FINEST: Getting
internaldb.ldapauth.clientCertNickname=subsystemCert cert-pki-ca
2021-01-12 20:50:50 [main] FINEST: Property tcp.keepAlive not found
2021-01-12 20:50:50 [main] FINEST: Getting tcp.keepAlive=true
2021-01-12 20:50:50 [main] FINE: TCP Keep-Alive: true
2021-01-12 20:50:50 [main] FINE: LdapBoundConnection: Connecting to
oats.ipa.amnesium.com.au:636 with client cert auth
2021-01-12 20:50:50 [main] FINE:
ldapconn/PKISocketFactory.makeSSLSocket: begins
2021-01-12 20:50:50 [main] FINE: SignedAuditLogger: event
CLIENT_ACCESS_SESSION_ESTABLISH
2021-01-12 20:50:50 [main] FINEST: Getting pidDir=/var/run/pki/tomcat
2021-01-12 20:50:50 [main] FINEST: Getting pidDir=/var/run/pki/tomcat
2021-01-12 20:50:50 [main] SEVERE: Unable to create socket:
java.net.ConnectException: Connection refused (Connection refused)
java.net.ConnectException: Connection refused (Connection refused)
at java.net.PlainSocketImpl.socketConnect(Native Method)
at
java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java
:350)
at
java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketIm
pl.java:206)
at
java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:1
88)
.....
1 day, 5 hours
mkhomedir recommendation?
by Dominik Vogt
ipa-client-install has the --mkhomedir option based on
pam_mkhomedir. RHEL8 seems to prefer oddjob-mkhomedir instead.
What's the recommended method for RHEL8.x please?
Ciao
Dominik ^_^ ^_^
--
Dominik Vogt
1 day, 6 hours
Password authentication fails for AD users on some systems
by Ronald Wimmer
On some systems I cannot login using the password-based method. I see a
pam_sss authentication failure (Permission denied). Using a valid
kerberos ticket for login works. (The same user works password-based on
other systems.)
What could possibly be the problem?
Cheers,
Ronald
1 day, 8 hours
login to host issue
by Patterson, David
Hello,
IPA version 4.6.8.
Got a host that doesn't allow user logins, but was joined at some point to the domain.
Everything that I can think of to check appears to be working
Log into client system with local credentials
Logs show invalid user attempts
Client Keytab looks valid.....do these ever expire?
Ktutil
read_kt /etc/krb5.keytab
list
Shows the host/hostname.domain
Quit
Cannot 'id admin' or 'id' any other user
Can obtain Kerberos keys for admin
Can run ipa user-show for any user
System appears valid in idmweb gui
What did I miss?
Get a new keytab for the client with ipa-getkeytab?
Is there some server/client certs I should be checking?
Thanks!
David Patterson
1 day, 18 hours
A Couple Admin Quality of Life Tools
by Noah Bliss
Hey all,
Just wanted to share a couple of tools I whipped up to flesh out some of the more time consuming or lean feature areas of FreeIPA. Hopefully they help you! Pull Reuquests and Issues are welcome.
https://github.com/noahbliss/freeipa-sam
FreeIPA-SAM is a simple menu-driven bash script for lifecycle management of system (service) accounts in LDAP. As a refresher, these seem to be the accounts you use as connectors to various services, but not for typical human user login. As there doesn't seem to be a convenient way to manage these in the WebUI and consistency is key when doing manual account management, I've found this to be a huge time-saver.
https://github.com/noahbliss/freeipa-pen
FreeIPA-PEN is a bash script designed to be installed on an IPA server and invoked by cron. It uses a system account to check LDAP and notify users via email if their password is going to expire soon. For accounts that do not have an email address or have already expired, it can generate a weekly/monthly report for you as an admin.
Best regards,
Noah
2 days, 1 hour