ipa healthcheck issue
by Patterson, David
Hello,
Running RHEL 7.9, ipa 4.6.8-5 and freeipa-healthcheck 0.3-2 backported for RHEL 7.
Ipa healthcheck output
[
{
"source": "ipahealthcheck.ipa.certs",
"kw": {
"msg": "Unable to retrieve cert 'host/idm2.X.Y' from '/etc/pki/nssdb': Failed to get host/idm2.X.Y",
"nickname": "host/idm2.X.Y",
"dbdir": "/etc/pki/nssdb",
"key": "20191122115414",
"error": "Failed to get host/idm2.X.Y"
},
"uuid": "64d9b118-e588-4dbb-99e1-6ef11e495ed5",
"duration": "0.382404",
"when": "20210107005140Z",
"check": "IPACertfileExpirationCheck",
"result": "ERROR"
},
{
"source": "ipahealthcheck.ipa.certs",
"kw": {
"msg": "Unknown certmonger id 20191122115414",
"key": "20191122115414"
},
"uuid": "1b4bba70-08e0-43dc-8984-657cc47fd339",
"duration": "1.109733",
"when": "20210107005142Z",
"check": "IPACertTracking",
"result": "WARNING"
}
]
How do I correct these issues?
Thanks!
David Patterson
3 years, 3 months
web-interface from Master-Server not available, DNSSEC-Service down
by Kay Jeschonneck
Issue
I can't use the web-interface from the master-server. I can open the website but i see only a white page. One the replica-server i can use the web-interface without a problem.
Also i get an error from ipa-ods-exporter about "Public key with same ID already exists", this problem start after i remove the dnssec service and reinstall it on the master-server.
Bevor i removed the dnssec-service i have remove over the replica-web-interface all dnssec-entries.
Steps to Reproduce
I can't because i don't know the cause.
I think the problem start after a update but i don't know itexactly.
Actual behavior
web-interface is not available and dnssec issue
Expected behavior
web-interface is available and no dnssec errors
Version/Release/Distribution
$uname -r
4.18.0-240.1.1.el8_3.x86_64
$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.8.7-13.module_el8.3.0+606+1e8766d7.x86_64
ipa-client-4.8.7-13.module_el8.3.0+606+1e8766d7.x86_64
389-ds-base-1.4.3.8-6.module_el8.3.0+604+ab7bf9cc.x86_64
pki-ca-10.9.4-1.module_el8.3.0+500+458aeb54.noarch
krb5-server-1.18.2-5.el8.x86_64
Additional info:
please let me know if any particular logs, etc you might need.
3 years, 3 months
Sudo Default Environment
by Mark Potter
I am trying to create a default sudo environment that is applied to all
users in addition to anything from other groups. This would include things
like "secure_path" and a few env lines. However I cannot seem to get this
to work. I understand that the highest number in "Sudo order" is processed
first but regardless of ordering I cannot seem to apply a default along
with other sudo groups. I would expect that if this default was numbered
"1" and everything else was higher that it would apply the Sudo options
what I'm seeing in practice is that the options aren't additive and if a
higher numbered rule doesn't contain them that they are removed. Is this
the expected behavior here?
For example if I have:
env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
In a sudo group called "Default" and that group is set for all users on all
hosts with Commands and As whom all set to "Specified" with Sudo order of
1, then a group called "IT" with set for all users, all hosts, all
commands, any user, any group with a Sudo order of 2 it appears that the
Sudo options aren't applied and only what's set for "IT".
If there is no inheritance I can work with that but I would be brilliant if
I I have simply missed something simple and can configure a default set of
options.
--
*Mark Potter*
Senior Linux Administrator
3 years, 3 months
Slow Logins on all clients
by Mark Potter
We are experiencing slow logins on all client machines. At present this is
only two machines but have experienced the same issue with prior
installations. We have migrated the entirety of our ancient OpenLDAP
install to FreeIPA. Our environment is:
1 x IPA Server
3 x IPA Replicas
All of these have the following specs:
Memory: 16GiB
CPU: 6 Cores
Disk: 64GiB
When a client has its cache cleared or it has expired, such as not being
logged into overnight, we have seen quite a delay logging in, especially
compared to our antiquated OpenLDAP install. In a test this morning the two
clients took ~30 seconds for the first login of the day. Once this delay is
seen it is not seen again for a while (I haven't timed it at this point).
In the logs I see the following:
21k instance of:
[sssd[be[example.com]]] [sdap_process_ghost_members] (0x0400): Adding ghost
member for group [user286(a)example.com]
32k instances of:
[sssd[be[example.com]]] [sdap_get_primary_name] (0x0400): Processing object
user767
151 instances of (the only result for grepping the log for "fail")
[sssd[be[example.com]]] [sdap_save_grpmem] (0x0400): Failed to get group sid
148 instances of (the only result for grepping the log for "warn"):
[sssd[be[example.com]]] [sdap_get_generic_ext_send] (0x0400): WARNING:
Disabling paging because scope is set to base.
These cover multiple users and multiple groups. I can provide logs but a
clean log and a single login at log level 6 generated a 7.2 MiB log file.
It looks like it's doing some sort of enumeration but I don't know enough
to know what exactly is going on.
The load on the IPA server and replicas isn't remotely high at any point.
We will end up with > 8k machines authenticating to this cluster so ~30
seconds to login to any given machine for jobs is a lot of lost time.
---sssd.conf---
[domain/dug.com]
cache_credentials = True
debug_level = 6
krb5_store_password_if_offline = True
ipa_domain = example.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = client0001.example.com
chpass_provider = ipa
ipa_server = _srv_, ipa0001.example.com, ipa0002.example.com,
ipa0003.example.com, ipa0004.example.com
ldap_tls_cacert = /etc/ipa/ca.crt
autofs_provider = ipa
ipa_automount_location = local-map
[sssd]
services = nss, sudo, pam, autofs, ssh
domains = example.com
[nss]
homedir_substring = /home
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
[secrets]
[session_recording]
---sssd.conf---
Any help would be appreciated!
--
*Mark Potter*
Senior Linux Administrator
3 years, 3 months
expired lets encrypt certificates - how to fix/reinstall
by Sinh Lam
So I have this problem where the certificates have expired. I created a new one but however when trying to apply the new certs using ipa-server-certinstall, http works but when trying to get it to apply to ldap it fails with a "peer's certificate issuer is not recognized".
looking at the logs it looks like the PKI-TOMCAT instances keeps failing, which then following it, the CA is not running, and continuing to follow the trail the certmonger service is failing to start as well with a variety of errors.
so my path now is a) keep trying to recover or b) do a reinstall.
if I choose option b, will any data (ldap or otherwise) be completely wiped? I'm more interested in preserving the DNS and user/group data more than anything.
running IPA 4.8.7-12 on CentOS 8.
getcert list output :
Request ID '20200412103127':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
CA: IPA
issuer: CN=Certificate Authority,O=XXXX.NET
--
Request ID '20210102080335':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=XXXX.NET
--
Request ID '20210102080336':
status: CA_UNREACHABLE
ca-error: Error 7 connecting to http://ipa.xxxx.net:8080/ca/ee/ca/profileSubmit: Couldn't connect to server.
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
--
Request ID '20210102080337':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=XXXX.NET
--
Request ID '20210102080338':
status: CA_UNREACHABLE
ca-error: Error 7 connecting to http://ipa.xxxx.net:8080/ca/ee/ca/profileSubmit: Couldn't connect to server.
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
--
Request ID '20210102080339':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=XXXX.NET
--
Request ID '20210102080340':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=XXXX.NET
--
Request ID '20210104092449':
status: CA_UNCONFIGURED
ca-error: Unable to determine principal name for signing request.
stuck: yes
key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-XXXX-NET',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-XXXX-NET/pwdfile.txt'
certificate: type=NSSDB,location='/etc/dirsrv/slapd-XXXX-NET',nickname='Server-Cert'
CA: IPA
--
Request ID '20210104093724':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/etc/letsencrypt/live/ipa.xxxx.net/privkey.pem'
certificate: type=FILE,location='/etc/letsencrypt/live/ipa.xxxx.net/fullchain.pem'
CA: IPA
issuer: CN=R3,O=Let's Encrypt,C=US
(domain info edited out)
I can provide whatever log/output needed to help me get past this problem.
thanks.
3 years, 3 months
Performance impact of trustdomain-disable
by Ronald Wimmer
Some colleagues are complaining about long login times when using SSH to
log in. Today I was reading about trustomain-delete in case of trusts to
a forest root where only some domains are relevant.
In our use case we have a trust to a AD forest root domain that includes
two other domains. Lets name them
mydomain.at (AD forest root domain - IPA has trust to this one)
domainone.mydomain.at
domaintwo.mydomain.at
Only domainone.mydomain.at holds users we want to use. Would SSH login
performance increase dramatically if I disabled all domains I do not
need (mydomain.at and domaintwo.mydomain.at)?
Cheers,
Ronald
3 years, 3 months
Running ipa commands through Ansible
by Dominik Vogt
We have to set up the ipa-server with Ansible scripts, but there
isn't a module for everything. For example, this command needs to
be executed.
- name: ...
shell: ipa config-mod --ipaselinuxusermaporder="..."
However, that doesn't work (using either the "root" or ipa "admin"
accounts) because the Kerberos ticket granting ticket is missing.
Hard coding user and password in a plain script or on the command
line is bad. I've really no idea how to solve this.
P.S.: The existing ipa modules for Ansible seem to do their work
over the http interface.
Ciao
Dominik ^_^ ^_^
--
Dominik Vogt
3 years, 3 months
Re: Remove unused external ca certs
by Rob Crittenden
Dungan, Scott A. via FreeIPA-users wrote:
> Happy new year, everyone.
>
> Â
>
> We have an unused letsencrypt CA cert and associated the DSTRootCAX3
> cert installed on version 4.8.7. Due to firewall issues, we moved to a
> paid commercial cert (Comodo) for the https service. My question is, how
> can we remove the two unused CA certs? If we do so, is it necessary to
> update the clients with ipa-certupdate, or will the removal be transparent?
>
> Â
>
> ~]# ipa-cacert-manage list
>
> xxx.xxx.xxx.edu IPA CA
>
> DSTRootCAX3
>
> letsencryptx3
>
> CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater
> Manchester,C=GB
>
> CN=USERTrust RSA Certification Authority,O=The USERTRUST
> Network,L=Jersey City,ST=New Jersey,C=US
>
> CN=InCommon RSA Server CA,OU=InCommon,O=Internet2,L=Ann Arbor,ST=MI,C=US
>
> The ipa-cacert-manage command was successful
From ipa-cacert-manage(1):
SYNOPSIS
...
ipa-cacert-manage delete [options] NICKNAME
ipa-certupdate will need to be run on all enrolled machines.
rob
3 years, 3 months
Remove unused external ca certs
by Dungan, Scott A.
Happy new year, everyone.
We have an unused letsencrypt CA cert and associated the DSTRootCAX3 cert installed on version 4.8.7. Due to firewall issues, we moved to a paid commercial cert (Comodo) for the https service. My question is, how can we remove the two unused CA certs? If we do so, is it necessary to update the clients with ipa-certupdate, or will the removal be transparent?
~]# ipa-cacert-manage list
xxx.xxx.xxx.edu IPA CA
DSTRootCAX3
letsencryptx3
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=InCommon RSA Server CA,OU=InCommon,O=Internet2,L=Ann Arbor,ST=MI,C=US
The ipa-cacert-manage command was successful
-Scott
3 years, 3 months
Installation problem - Request timed out on Step [12/30] during pki-tomcatd configuration
by Chris Clemson
Hello everyone,
I am trying to install FreeIPA on a new CentOS VM, and have got stuck.
OS is "CentOS Linux release 7.9.2009", "minimal" installation, and
latest updates installed as of today.
Nothing else is configured on it.
I issued ipa-server-install, (responded "no" to setting up DNS as that
is running on another server) and it has got to the pki-tomcatd
configuration part.
At step 12/30, it says "requesting RA certificate from CA", and then
[error] RuntimeError: request timed out
ipapython.admintool: ERROR request timed out
ipapython.admintool: ERROR The ipa-server-install command failed. See
/var/log/ipaserver-install.log for more information.
It has now been sitting there for over an hour and the shell prompt has
not returned.
in /var/log/ipaserver-install.log i get the message "DEBUG certmonger
request is in state dbus.String(u'SUBMITTING', variant_level=1)"
repeated for around 6 minutes, and then the following is printed:
2021-01-05T23:14:25Z DEBUG certmonger request is in state
dbus.String(u'PRE_SAVE_CERT', variant_level=1)
2021-01-05T23:14:42Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py",
line 567, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py",
line 557, in run_step
method()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line
943, in __request_ra_certificate
resubmit_timeout=api.env.replication_wait_timeout
File "/usr/lib/python2.7/site-packages/ipalib/install/certmonger.py",
line 332, in request_and_wait_for_cert
state = wait_for_request(req_id, api.env.replication_wait_timeout)
File "/usr/lib/python2.7/site-packages/ipalib/install/certmonger.py",
line 709, in wait_for_request
raise RuntimeError("request timed out")
RuntimeError: request timed out
Somebody here:
https://www.linuxquestions.org/questions/linux-server-73/slowness-after-i...
mentioned DNS problems, but nslookup seems to be resolving things fine.
Any idea what I can do to fix the issue?
Thanks,
Chris
3 years, 3 months