ipa commands have 30 second delay
by Dominik Vogt
We've set up an ipa-server without DNS, using an /etc/hosts file,
as was suggested in an older thread:
https://www.mail-archive.com/freeipa-users@lists.fedorahosted.org/msg1099...
There's no DNS at all available, and /etc/nsswitch contains the
defaults ("hosts: files dns myhostname", but it's the same if I
change that to just "hosts: files" and remove /etc/rsolv.conf).
Ipa commands all take 30 seconds, but fine eventually. E.g.
$ ipa user-find --all
Strace shows that the process is sending a request to the DNS port
on the ip address configured in /etc/resolv.conf, or 127.0.0.1 if
that file does not exist. he conents of nsswitch.conf are
ignored.
So, how can this be fixed? Do we have to set up DNS to run the
ipa-server?
Ciao
Dominik ^_^ ^_^
--
Dominik Vogt
3 years, 3 months
create new ca and new certs for
by Evg Hertz
IPA Error 4301: CertificateOperationError
Certificate operation cannot be completed: EXCEPTION (You did not provide a valid certificate for this operation)
Failed to authenticate to CA REST API
Hello!
I need create new CA cert and certs directory server, http server, KDC.
How I can do that?
3 years, 3 months
healthcheck errors
by Prasun Gera
I'm seeing the following two errors on running ipahealthcheck. This is on
an up to date RHEL 8.3 system in a 2 server topology with self signed CA.
DOMAIN.COM IPA CA not found, assuming 3rd party
DOMAIN.COM IPA CA not found, assuming 3rd party
[
{
"source": "pki.server.healthcheck.meta.csconfig",
"check": "CADogtagCertsConfigCheck",
"result": "ERROR",
"uuid": "da820035-6955-436f-9bf5-bde578b27920",
"when": "20201221130025Z",
"duration": "0.172261",
"kw": {
"key": "ca_signing",
"nickname": "caSigningCert cert-pki-ca",
"directive": "ca.signing.cert",
"configfile": "/var/lib/pki/pki-tomcat/ca/conf/CS.cfg",
"msg": "Certificate 'caSigningCert cert-pki-ca' does not match the
value of ca.signing.cert in /var/lib/pki/pki-tomcat/ca/conf/CS.cfg"
}
},
{
"source": "ipahealthcheck.ipa.certs",
"check": "IPACertTracking",
"result": "ERROR",
"uuid": "cfba0bf1-4e4b-40d6-9d26-455bab9c9057",
"when": "20201221130027Z",
"duration": "0.307626",
"kw": {
"key": "cert-database=/etc/pki/pki-tomcat/alias,
cert-nickname=caSigningCert cert-pki-ca, ca-name=dogtag-ipa-ca-renew-agent,
cert-presave-command=/usr/libexec/ipa/certmonger/stop_pkicad,
cert-postsave-command=/usr/libexec/ipa/certmonger/renew_ca_cert
\"caSigningCert cert-pki-ca\", template-profile=caCACert",
"msg": "Missing tracking for cert-database=/etc/pki/pki-tomcat/alias,
cert-nickname=caSigningCert cert-pki-ca, ca-name=dogtag-ipa-ca-renew-agent,
cert-presave-command=/usr/libexec/ipa/certmonger/stop_pkicad,
cert-postsave-command=/usr/libexec/ipa/certmonger/renew_ca_cert
\"caSigningCert cert-pki-ca\", template-profile=caCACert"
}
},
...
]
1. This is with a self-signed CA. So I don't know why it has that
assuming 3rd party message.
2. I think this has something to do with the fact
that /etc/pki/pki-tomcat/alias/ has two certs under the nickname
of "caSigningCert cert-pki-ca", (one for each of the masters I presume),
but somehow only 1 cert is tracked in other parts of the
infrastructure. /var/lib/pki/pki-tomcat/ca/conf/CS.cfg lists a single
certificate under ca.signing.cert and there is also a single entry in LDAP
(which is the same as CS.cfg). Is something broken in my setup ?
Thanks,
Prasun
3 years, 3 months
repair ca
by Evg Hertz
Hello I need to fix CA
Failed to authenticate to CA REST API
How I can reinstall/reconfigure only CA.
or export users(with hash passwords)/groups. and import on new installation.
Help me please.
3 years, 3 months
Jenkins FreeIPA LDAP integration
by anilkumar panditi
Hi,
I have freeipa running as a docker container, and don't have all the
details with me.
i was looking for a few details see attached for Jenkins FreeIPA LDAP
integration.
I am not sure where the Manager DN id and password is stored inside my
freeipa docker container .
Could you please help, i am really stuck
Thanks,
Anil
3 years, 3 months
Access LOG Files / configuration - zip ?
by Karim Bourenane
Hello Team
Its possible to know where the access log files in
/var/log/dirsrv/slapd...../
are configured. Its possible to active the gzip process for this files ?
Happy holidays
Bien à vous
Mr Karim Bourenane
3 years, 3 months
Insufficient access
by Ivan Isakov
Hello,
When I try to perform command after command kinit admin:
ipa group-remove-member group --users=test
I get next:
Failed members:
member user: test: Insufficient access: Insufficient 'write' privilege to
the 'member' attribute of entry...
How can I fix it?
Help, please!
3 years, 3 months