Login failed due to an unknown reason.
by D R
Greetings,
After automatic KDC certificate renewal, I'm no longer able to access the
UI.
[Sun Dec 27 23:33:20.563064 2020] [:error] [pid 6150] [remote
10.xx.xx.22:72] Traceback (most recent call last):
[Sun Dec 27 23:33:20.563085 2020] [:error] [pid 6150] [remote
10.xx.xx.22:72] File "/usr/share/ipa/wsgi.py", line 59, in application
[Sun Dec 27 23:33:20.563121 2020] [:error] [pid 6150] [remote
10.xx.xx.22:72] return api.Backend.wsgi_dispatch(environ,
start_response)
[Sun Dec 27 23:33:20.563129 2020] [:error] [pid 6150] [remote
10.xx.xx.22:72] File
"/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 267, in
__call__
[Sun Dec 27 23:33:20.563142 2020] [:error] [pid 6150] [remote
10.xx.xx.22:72] return self.route(environ, start_response)
[Sun Dec 27 23:33:20.563160 2020] [:error] [pid 6150] [remote
10.xx.xx.22:72] File
"/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 279, in
route
[Sun Dec 27 23:33:20.563170 2020] [:error] [pid 6150] [remote
10.xx.xx.22:72] return app(environ, start_response)
[Sun Dec 27 23:33:20.563174 2020] [:error] [pid 6150] [remote
10.xx.xx.22:72] File
"/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 937, in
__call__
[Sun Dec 27 23:33:20.563182 2020] [:error] [pid 6150] [remote
10.xx.xx.22:72] self.kinit(user_principal, password, ipa_ccache_name)
[Sun Dec 27 23:33:20.563194 2020] [:error] [pid 6150] [remote
10.xx.xx.22:72] File
"/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 973, in
kinit
[Sun Dec 27 23:33:20.563201 2020] [:error] [pid 6150] [remote
10.xx.xx.22:72] pkinit_anchors=[paths.KDC_CERT,
paths.KDC_CA_BUNDLE_PEM],
[Sun Dec 27 23:33:20.563209 2020] [:error] [pid 6150] [remote
10.xx.xx.22:72] File
"/usr/lib/python2.7/site-packages/ipalib/install/kinit.py", line 127, in
kinit_armor
[Sun Dec 27 23:33:20.563219 2020] [:error] [pid 6150] [remote
10.xx.xx.22:72] run(args, env=env, raiseonerr=True, capture_error=True)
[Sun Dec 27 23:33:20.563225 2020] [:error] [pid 6150] [remote
10.xx.xx.22:72] File
"/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 563, in run
[Sun Dec 27 23:33:20.563234 2020] [:error] [pid 6150] [remote
10.xx.xx.22:72] raise CalledProcessError(p.returncode, arg_string,
str(output))
[Sun Dec 27 23:33:20.563263 2020] [:error] [pid 6150] [remote
10.xx.xx.22:72] CalledProcessError: Command '/usr/bin/kinit -n -c
/var/run/ipa/ccaches/armor_6150 -X
X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X
X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem' returned
non-zero exit status 1
---
KRB5_TRACE=/dev/stdout /usr/bin/kinit -n -c
/var/run/ipa/ccaches/armor_19265 -X
X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X
X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
[12904] 1609104974.342210: Getting initial credentials for WELLKNOWN/
ANONYMOUS(a)A-LABS.COM
[12904] 1609104974.342212: Sending unauthenticated request
[12904] 1609104974.342213: Sending request (184 bytes) to A-LABS.COM
[12904] 1609104974.342214: Initiating TCP connection to stream
10.xx.xx.90:88
[12904] 1609104974.342215: Sending TCP request to stream 10.xx.xx.90:88
[12904] 1609104974.342216: Received answer (335 bytes) from stream
10.xx.xx.90:88
[12904] 1609104974.342217: Terminating TCP connection to stream
10.xx.xx.90:88
[12904] 1609104974.342218: Response was from master KDC
[12904] 1609104974.342219: Received error from KDC: -1765328359/Additional
pre-authentication required
[12904] 1609104974.342222: Preauthenticating using KDC method data
[12904] 1609104974.342223: Processing preauth types: PA-PK-AS-REQ (16),
PA-PK-AS-REP_OLD (15), PA-PK-AS-REQ_OLD (14), PA-FX-FAST (136),
PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENC-TIMESTAMP (2), PA-FX-COOKIE
(133)
[12904] 1609104974.342224: Selected etype info: etype aes256-cts, salt
"A-LABS.COMWELLKNOWNANONYMOUS", params ""
[12904] 1609104974.342225: Received cookie: MIT
[12904] 1609104974.342226: Preauth module pkinit (147) (info) returned:
0/Success
[12904] 1609104974.342227: PKINIT loading CA certs and CRLs from FILE
[12904] 1609104974.342228: PKINIT loading CA certs and CRLs from FILE
[12904] 1609104974.342229: PKINIT loading CA certs and CRLs from FILE
[12904] 1609104974.342230: PKINIT client computed kdc-req-body checksum
9/D4FAE675E4E8C9664DBE0FAD0EB8C416A639CAF3
[12904] 1609104974.342232: PKINIT client making DH request
[12904] 1609104974.342233: Preauth module pkinit (16) (real) returned:
0/Success
[12904] 1609104974.342234: Produced preauth for next request: PA-FX-COOKIE
(133), PA-PK-AS-REQ (16)
[12904] 1609104974.342235: Sending request (1497 bytes) to A-LABS.COM
[12904] 1609104974.342236: Initiating TCP connection to stream
10.xx.xx.90:88
[12904] 1609104974.342237: Sending TCP request to stream 10.xx.xx.90:88
[12904] 1609104974.342238: Received answer (1603 bytes) from stream
10.xx.xx.90:88
[12904] 1609104974.342239: Terminating TCP connection to stream
10.xx.xx.90:88
[12904] 1609104974.342240: Response was from master KDC
[12904] 1609104974.342241: Processing preauth types: PA-PK-AS-REP (17),
PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147)
[12904] 1609104974.342242: Selected etype info: etype aes256-cts, salt
"A-LABS.COMWELLKNOWNANONYMOUS", params ""
[12904] 1609104974.342243: Preauth module pkinit (147) (info) returned:
0/Success
[12904] 1609104974.342244: PKINIT client verified DH reply
[12904] 1609104974.342245: Preauth module pkinit (17) (real) returned:
-1765328308/KDC name mismatch
[12904] 1609104974.342246: Produced preauth for next request: (empty)
[12904] 1609104974.342247: Getting AS key, salt
"A-LABS.COMWELLKNOWNANONYMOUS", params ""
Password for WELLKNOWN/ANONYMOUS(a)A-LABS.COM:
[12904] 1609104977.873071: AS key obtained from gak_fct: aes256-cts/B8BD
kinit: Password incorrect while getting initial credentials
--
openssl x509 -in /var/kerberos/krb5kdc/kdc.crt -text -noout
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 10 (0xa)
Signature Algorithm: sha256WithRSAEncryption
Issuer: O=DOMAIN.COM, CN=ipa.domain.com
Validity
Not Before: Dec 27 07:38:54 2020 GMT
Not After : Dec 27 07:38:54 2021 GMT
Subject: O=DOMAIN.COM, CN=ipa.domain.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:cc:6e:b1:b1:2d:05:ab:f1:df:ce:01:43:d5:80:
4a:f6:72:38:3c:50:aa:c7:40:bf:bd:6c:60:5e:8d:
d0:f3:2b:6c:db:fc:8f:48:9f:91:d6:d3:d2:43:f2:
39:35:17:56:37:a8:6f:66:c3:ab:1f:13:8f:d9:48:
c3:be:b9:2b:83:77:78:08:fe:3b:f8:93:83:1c:bb:
d0:e8:eb:49:a5:c1:8c:7f:0c:b5:fa:e7:07:f1:0c:
97:9b:47:e9:a2:a3:ab:9b:c1:70:e3:1b:e9:f2:3d:
2f:96:53:6d:38:eb:57:19:7f:dd:ed:e8:3c:c8:f0:
7c:36:b1:72:03:f1:2f:86:8e:cd:67:fd:fd:85:73:
00:16:60:81:3c:ad:13:4d:19:c0:4d:e7:94:8d:34:
29:99:7a:45:70:db:81:5d:0e:2d:83:7a:9c:19:c7:
ef:0a:79:8d:84:af:74:a3:b9:90:c8:b1:8c:65:d0:
2d:e0:89:98:42:e0:cb:c8:b0:e3:b5:7c:9b:44:01:
a8:31:15:8d:19:79:c5:35:26:4d:3f:e6:83:64:7f:
15:da:50:c1:5e:9c:67:1b:27:e5:35:0c:a8:71:a9:
4e:ee:ef:92:b5:f9:10:f6:31:82:2c:94:04:05:c5:
89:c6:96:1d:48:11:e5:8d:05:92:56:93:99:55:66:
b0:93
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints: critical
CA:FALSE
Signature Algorithm: sha256WithRSAEncryption
To my understanding, something is wrong with the kdc certificate, it lacks
some attributes. I'm just not sure how to generate a proper cert.
1 year, 1 month
dirsrv hangs soon after reboot
by Kees Bakker
Hey,
I'm looking for advice how to analyse/debug this.
On one of the masters the dirsrv is unresponsive. It runs, but every
attempt to connect it hangs.
The command "systemctl status" does not show anything alarming
● dirsrv(a)EXAMPLE-COM.service - 389 Directory Server EXAMPLE-COM.
Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled; vendor preset: disabled)
Active: active (running) since vr 2020-04-17 13:46:25 CEST; 1h 33min ago
Process: 3123 ExecStartPre=/usr/sbin/ds_systemd_ask_password_acl /etc/dirsrv/slapd-%i/dse.ldif (code=exited, status=0/SUCCESS)
Main PID: 3134 (ns-slapd)
Status: "slapd started: Ready to process requests"
CGroup: /system.slice/system-dirsrv.slice/dirsrv(a)EXAMPLE-COM.service
└─3134 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-EXAMPLE-COM -i /var/run/dirsrv/slapd-EXAMPLE-COM.pid
apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1
apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1
apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1
apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1
apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 2
apr 17 15:18:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1
apr 17 15:18:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1
apr 17 15:18:55 linge.example.com ns-slapd[3134]: GSSAPI client step 1
apr 17 15:18:55 linge.example.com ns-slapd[3134]: GSSAPI client step 1
apr 17 15:18:55 linge.example.com ns-slapd[3134]: GSSAPI client step 2
However, an ldapsearch command hangs forever
[root@rotte ~]# ldapsearch -H ldaps://linge.example.com -D uid=keesbtest,cn=users,cn=accounts,dc=example,dc=com -W -LLL -o ldif-wrap=no -b cn=users,cn=accounts,dc=example,dc=com '(&(objectClass=person)(memberOf=cn=admins,cn=groups,cn=accounts,dc=example,dc=com))' uid
Enter LDAP Password:
Even if I use the socket (ldapi://%2fvar%2frun%2fslapd-EXAMPLE-COM.socket) the ldapsearch
command hangs.
"ipactl status" hangs
"kinit" hangs
--
Kees Bakker
1 year, 1 month
using SSH with password authentication when NIS is still running with FreeIPA
by Robert Kudyba
We have freeipa-server-4.8.10-6.fc33 running on top of NIS and I'm trying
to determine why ssh -k from any client is hanging and not even connecting.
Does sssd need to be configured as in this 2013 training document?
https://www.freeipa.org/images/1/10/Freeipa30_SSSD_OpenSSH_integration.pdf
The goal is to eliminate NIS so perhaps the issue is running both
concurrently? The good news is, thanks to tips here last week, all the NIS
users migrated along with their passwords. And kinit on the Free IPA server
even prompts to change their password.
sssd is running:
sssd_be[2329]: GSSAPI client step 1
sssd_be[2329]: GSSAPI client step 2
/etc/krb.conf
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = ourserver.EDU
dns_lookup_realm = true
dns_lookup_kdc = true
rdns = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
ourserver.EDU = {
kdc = ourserver.edu:88
master_kdc = ourserver.edu:88
admin_server = ourserver.edu:749
default_domain = ourserver.edu
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.ourserver.edu = ourserver.EDU
ourserver.edu = ourserver.EDU
ourserver.edu = ourserver.EDU
[dbmodules]
ourserver.EDU = {
db_library = ipadb.so
}
[plugins]
certauth = {
module = ipakdb:kdb/ipadb.so
enable_only = ipakdb
}
HBAC is wide open:
ipa hbacrule-find
--------------------
2 HBAC rules matched
--------------------
Rule name: allow_all
User category: all
Host category: all
Service category: all
Description: Allow all users to access any host from any host
Enabled: TRUE
Rule name: allow_systemd-user
User category: all
Host category: all
Description: Allow pam_systemd to run user@.service to create a system
user session
Enabled: TRUE
Here are some debug ssh server logs:
Feb 8 16:23:27 ourserver sshd[381563]: debug1: Forked child 510395.
Feb 8 16:23:27 ourserver sshd[510395]: debug1: Set
/proc/self/oom_score_adj to 0
Feb 8 16:23:27 ourserver sshd[510395]: debug1: rexec start in 5 out 5
newsock 5 pipe 10 sock 11
Feb 8 16:23:27 ourserver sshd[510395]: debug1: inetd sockets after
dupping: 4, 4
Feb 8 16:23:27 ourserver sshd[510395]: Connection from 150.108.68.26 port
45806 on 150.108.64.156 port 22 rdomain ""
Feb 8 16:23:27 ourserver sshd[510395]: debug1: Local version string
SSH-2.0-OpenSSH_8.4
Feb 8 16:23:27 ourserver sshd[510395]: debug1: Remote protocol version
2.0, remote software version OpenSSH_8.4
Feb 8 16:23:27 ourserver sshd[510395]: debug1: match: OpenSSH_8.4 pat
OpenSSH* compat 0x04000000
Feb 8 16:23:27 ourserver sshd[510395]: debug1: SELinux support disabled
[preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: permanently_set_uid: 74/74
[preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: list_hostkey_types:
rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: SSH2_MSG_KEXINIT sent
[preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: SSH2_MSG_KEXINIT received
[preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: kex: algorithm:
curve25519-sha256 [preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: kex: host key algorithm:
ecdsa-sha2-nistp256 [preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: kex: client->server cipher:
aes256-gcm(a)openssh.com MAC: <implicit> compression: none [preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: kex: server->client cipher:
aes256-gcm(a)openssh.com MAC: <implicit> compression: none [preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: kex: curve25519-sha256
need=32 dh_need=32 [preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: kex: curve25519-sha256
need=32 dh_need=32 [preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: expecting
SSH2_MSG_KEX_ECDH_INIT [preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: rekey out after 4294967296
blocks [preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: SSH2_MSG_NEWKEYS sent
[preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: Sending SSH2_MSG_EXT_INFO
[preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: expecting SSH2_MSG_NEWKEYS
[preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: SSH2_MSG_NEWKEYS received
[preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: rekey in after 4294967296
blocks [preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: KEX done [preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: userauth-request for user
ouruser service ssh-connection method none [preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: attempt 0 failures 0
[preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: PAM: initializing for
"ouruser"
Feb 8 16:23:27 ourserver sshd[510395]: debug1: PAM: setting PAM_RHOST to
"xx.xx.xx.xx"
Feb 8 16:23:27 ourserver sshd[510395]: debug1: PAM: setting PAM_TTY to
"ssh"
Feb 8 16:23:27 ourserver sshd[510395]: debug1: userauth-request for user
ouruser service ssh-connection method publickey [preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: attempt 1 failures 0
[preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: userauth_pubkey: test pkalg
rsa-sha2-256 pkblob RSA SHA256:++6z7fhR603SUI0fWp7k7noRz1/41+9/hM/rWjNQlXk
[preauth]
Feb 8 16:23:27 ourserver sshd[510395]: debug1: temporarily_use_uid:
5879/200 (e=0/0)
Feb 8 16:23:27 ourserver sshd[510395]: debug1: trying public key file
/home/ouruser/.ssh/authorized_keys
and ssh -k from a Fedora client, note the user I'm logged in as is NOT the
same user I'm trying to log in to:
ssh -vv -k ouruser@ourserver
OpenSSH_8.4p1, OpenSSL 1.1.1i FIPS 8 Dec 2020
debug1: Reading configuration data /home/ouruser/.ssh/config
debug1: /home/ouruser/.ssh/config line 1: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Reading configuration data /etc/ssh/ssh_config.d/50-redhat.conf
debug2: checking match for 'final all' host ourserver originally ourserver
debug2: match not found
debug1: Reading configuration data
/etc/crypto-policies/back-ends/openssh.config
debug1: configuration requests final Match pass
debug1: re-parsing configuration
debug1: Reading configuration data /home/ouruser/.ssh/config
debug1: /home/ouruser/.ssh/config line 1: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Reading configuration data /etc/ssh/ssh_config.d/50-redhat.conf
debug2: checking match for 'final all' host ourserver originally ourserver
debug2: match found
debug1: Reading configuration data
/etc/crypto-policies/back-ends/openssh.config
debug1: auto-mux: Trying existing master
debug1: Control socket "/home/ouruser/.ssh/sockets/ouruser@ourserver-22"
does not exist
debug2: resolving "ourserver" port 22
debug2: ssh_connect_direct
debug1: Connecting to ourserver [150.108.64.156] port 22.
debug1: Connection established.
debug1: identity file /home/ouruser/.ssh/id_rsa type 0
debug1: identity file /home/ouruser/.ssh/id_rsa-cert type -1
debug1: identity file /home/ouruser/.ssh/id_dsa type -1
debug1: identity file /home/ouruser/.ssh/id_dsa-cert type -1
debug1: identity file /home/ouruser/.ssh/id_ecdsa type -1
debug1: identity file /home/ouruser/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/ouruser/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/ouruser/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/ouruser/.ssh/id_ed25519 type 3
debug1: identity file /home/ouruser/.ssh/id_ed25519-cert type -1
debug1: identity file /home/ouruser/.ssh/id_ed25519_sk type -1
debug1: identity file /home/ouruser/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/ouruser/.ssh/id_xmss type -1
debug1: identity file /home/ouruser/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.4
debug1: match: OpenSSH_8.4 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to ourserver:22 as 'ouruser'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256(a)libssh.org
,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ext-info-c
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01(a)openssh.com,
ecdsa-sha2-nistp384-cert-v01(a)openssh.com,
ecdsa-sha2-nistp521-cert-v01(a)openssh.com,
sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01(a)openssh.com
,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01(a)openssh.com,
rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01(a)openssh.com
,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,sk-ssh-ed25519(a)openssh.com
,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: aes256-gcm@openssh.com,chacha20-poly1305(a)openssh.com
,aes256-ctr,aes128-gcm(a)openssh.com,aes128-ctr
debug2: ciphers stoc: aes256-gcm@openssh.com,chacha20-poly1305(a)openssh.com
,aes256-ctr,aes128-gcm(a)openssh.com,aes128-ctr
debug2: MACs ctos: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm(a)openssh.com,
umac-128-etm@openssh.com,hmac-sha2-512-etm(a)openssh.com
,hmac-sha2-256,hmac-sha1,umac-128(a)openssh.com,hmac-sha2-512
debug2: MACs stoc: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm(a)openssh.com,
umac-128-etm@openssh.com,hmac-sha2-512-etm(a)openssh.com
,hmac-sha2-256,hmac-sha1,umac-128(a)openssh.com,hmac-sha2-512
debug2: compression ctos: none,zlib(a)openssh.com,zlib
debug2: compression stoc: none,zlib(a)openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256(a)libssh.org
,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
debug2: host key algorithms:
rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: chacha20-poly1305(a)openssh.com
,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm(a)openssh.com,
aes256-gcm(a)openssh.com
debug2: ciphers stoc: chacha20-poly1305(a)openssh.com
,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm(a)openssh.com,
aes256-gcm(a)openssh.com
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm(a)openssh.com,
hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm(a)openssh.com,
hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128(a)openssh.com
,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm(a)openssh.com,
hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm(a)openssh.com,
hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128(a)openssh.com
,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib(a)openssh.com
debug2: compression stoc: none,zlib(a)openssh.com
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: aes256-gcm(a)openssh.com MAC: <implicit>
compression: none
debug1: kex: client->server cipher: aes256-gcm(a)openssh.com MAC: <implicit>
compression: none
debug1: kex: curve25519-sha256 need=32 dh_need=32
debug1: kex: curve25519-sha256 need=32 dh_need=32
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256
SHA256:XUXhRKNYwxAGhwVIMa3fuo8uNMay6q4/qVeSWlQAOpM
debug1: Host 'ourserver' is known and matches the ECDSA host key.
debug1: Found key in /home/ouruser/.ssh/known_hosts:46
debug2: set_newkeys: mode 1
debug1: rekey out after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey in after 4294967296 blocks
debug1: Will attempt key: /home/ouruser/.ssh/id_rsa RSA
SHA256:++6z7fhR603SUI0fWp7k7noRz1/41+9/hM/rWjNQlXk
debug1: Will attempt key: /home/ouruser/.ssh/id_dsa
debug1: Will attempt key: /home/ouruser/.ssh/id_ecdsa
debug1: Will attempt key: /home/ouruser/.ssh/id_ecdsa_sk
debug1: Will attempt key: /home/ouruser/.ssh/id_ed25519 ED25519
SHA256:OoedE0VhmLFtl9nifW57Mca+GHDD0xKkJ2BCLGlV9xc
debug1: Will attempt key: /home/ouruser/.ssh/id_ed25519_sk
debug1: Will attempt key: /home/ouruser/.ssh/id_xmss
debug2: pubkey_prepare: done
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,
sk-ssh-ed25519(a)openssh.com
,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ecdsa-sha2-nistp256(a)openssh.com,
webauthn-sk-ecdsa-sha2-nistp256(a)openssh.com>
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue:
publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: KCM:)
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: KCM:)
debug2: we did not send a packet, disable method
debug1: Next authentication method: publickey
debug1: Offering public key: /home/ouruser/.ssh/id_rsa RSA
SHA256:++6z7fhR603SUI0fWp7k7noRz1/41+9/hM/rWjNQlXk
debug2: we sent a publickey packet, wait for reply
What am I missing? I appreciate the help last week!
Rob
1 year, 2 months
Missing mandatory attribute ipaNTSecurityIdentifier.
by Lachlan Simpson
Last week I was having SSSD issues and Sumit was sharp enough to pick out that I didn't allow enough RIDs.
( https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahoste... )
I increase the range by 5,000,000 via the GUI, restarted all two SSSD services (test ipa server, test client) after clearing their caches and it started to work.
For reasons, the IPA test server was power cycled and when it came back up, IPA wont start. `ipactl start` aborts because "Failed to start smb Service"
I am seeing the following in the samba logs:
[2021/02/23 14:57:23.259648, 0] ../../source3/smbd/server.c:1782(main)
smbd version 4.12.3 started.
Copyright Andrew Tridgell and the Samba Team 1992-2020
[2021/02/23 14:57:23.312207, 1] ../../source3/profile/profile.c:55(set_profile_level)
INFO: Profiling turned OFF from pid 2360
[2021/02/23 14:57:23.345139, 0] ipa_sam.c:3980(get_fallback_group_sid)
Missing mandatory attribute ipaNTSecurityIdentifier.
[2021/02/23 14:57:23.345184, 0] ipa_sam.c:4950(pdb_init_ipasam)
Cannot find SID of fallback group.
[2021/02/23 14:57:23.345194, 0] ../../source3/passdb/pdb_interface.c:180(make_pdb_method_name)
pdb backend ipasam:ldapi://%2fvar%2frun%2fslapd-TEST-IDM-COMPANY-COM.socket did not correctly init (error was NT_STATUS_INVALID_PARAMETER)
[2021/02/23 15:05:11.201577, 0] ../../source3/smbd/server.c:1782(main)
smbd version 4.12.3 started.
Copyright Andrew Tridgell and the Samba Team 1992-2020
[2021/02/23 15:05:11.212856, 1] ../../source3/profile/profile.c:55(set_profile_level)
INFO: Profiling turned OFF from pid 3146
[2021/02/23 15:05:11.234448, 0] ipa_sam.c:3980(get_fallback_group_sid)
Missing mandatory attribute ipaNTSecurityIdentifier.
A quick search suggests that potentially my change of the RID has affected SMB but I'm not 100% sure what to do next.
I guess I need to add an ipaNTSecurityIdentifier variable - but I'm not sure where.
This page https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/trust-i... suggests that I need to add a sidgen to the FreeIPA users that exist, but those users were created via the GUI - shouldn't the SID have been created then?
And if they didn't, how come I've been able to reboot successfully relatively frequently without this issue happening before - is it because I changed the value of that one domain's ID range?
Cheers
L.
1 year, 4 months
Problem adding DKIM record in DNS
by Kees Bakker
Hi,
This is a heads-up for people who want to add a DKIM TXT record in FreeIPA.
Adding a (long) TXT record with the DKIM key fails with a syntax error from named-pkcs11
The FreeIPA web UI did not show an error but with journalctl I see there is one.
feb 27 21:51:58 rotte.ghs.nl named-pkcs11[9314]: failed to parse RR entry: resource record DN 'idnsname=key._domainkey,idnsname=ghs.nl.,cn=dns,dc=ghs,dc=nl': data 'v=DKIM1; k=rsa; p=MIICIjANBgkqhkiG9w0B...Svu91xOnS5UfjsCAwEAAQ==': syntax error
feb 27 21:51:58 rotte.ghs.nl named-pkcs11[9314]: update_record (syncrepl) failed, resource record DN 'idnsname=key._domainkey,idnsname=ghs.nl.,cn=dns,dc=ghs,dc=nl' change type 0x2. Records can be outdated, run `rndc reload`: syntax error
There are two links that helped me solve the problem, [1] and [2].
Now I can see the DKIM record in DNS.
[1] https://robots.org.uk/FreeIPA#DNS:_long_TXT_records
[2] https://kb.isc.org/docs/aa-00356
--
Kees
1 year, 4 months
Apache Guacamole LDAP client 2FA authetication fails with Invalid Credentails.
by mir mal
Hi,
After 2FA sssd split into two prompts the LDAP client from Guacamole is failing. I've also opened a ticket with the Guacamole team but the response from LDAP is not indicating much is just an Invalid Credentials. It could be down to the way they do authentication as they do authentication once to check credentials and this part is working correctly but then they use TokenInjectingConnection and try to authenticate again to query Guacamole related properties if LDAP has been used to store Guacamole data, that part is failing and the whole process ends up with Invalid Login. When I switch back to password-only or password and top then it's working as expected. I had a similar issue with RDP and the solution was to change sssd.conf to a single prompt, however sssd.conf is for pam services not LDAP clients. Is there something I have to tweak in FreeIPA to get it to work with LDAP clients so the password and top is sent as a single password string, the same way you do it with RDP? Also, o
ther LDAP clients like Apache Directory or OPNSense PHP Ldap clients are working fine sending pwd+otp as a single string so I think it's down to the TokenInjectingConnection, maybe FreeIPA won't allow you to provided OTP twice in the same session and therefore sending InvalidCredentials.
The ticket I've open with the Guacamole team:
https://issues.apache.org/jira/browse/GUACAMOLE-1212?page=com.atlassian.j...
1 year, 4 months
default certificate validity length should be less than 1 year.
by Alan Latteri
Now that Mozilla and other browsers will not Trust a certificate with a validity length longer than a year, FreeIPA should change the default length to match. Currently IPA issues 2 year certificates, which make all the browsers view them as Un-Trusted. This defeats the purpose of cert issuance.
1 year, 4 months
ipa-adtrust-install on replicas
by Alan Latteri
Does ipa-adtrust-install need to be run on replicas for environments where there are ipa-clients being used as samba file servers?
Thanks,
Alan
1 year, 4 months
blank page for migration URL: File does not exist: /usr/share/ipa/ui/js/freeipa/menu.js
by Robert Kudyba
Running freeipa-server-4.9.1-1.fc33.x86_64 with httpd-2.4.46-9.fc33.x86_64
and the domain/ipa/migration page is blank. The only thing in the page
source is:
<!--[if IE]>
<meta id="ie-detector">
<![endif]-->
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<base href="../ui/" target="_blank">
<script type="text/javascript" src="../ui/js/libs/loader.js"></script>
<script type="text/javascript">
var dojoConfig = {
baseUrl: "js",
has: {
'dojo-firebug': false,
'dojo-debug-messages': true
},
parseOnLoad: false,
async: true,
packages: [
{
name:'dojo',
location:'dojo'
},
{
name: 'freeipa',
location: 'freeipa'
}
],
cacheBust: ipa_loader.num_version || ""
};
(function() {
var ie = !!document.getElementById('ie-detector');
var styles = [
'css/patternfly.css',
'css/ipa.css',
'ipa.css'
];
if (ie) styles.push('ie.css');
var icons = ['favicon.ico'];
var scripts = [
'js/libs/jquery.js',
'js/libs/jquery.ordered-map.js',
'js/dojo/dojo.js'
];
ipa_loader.scripts(scripts, function() {
require([
'freeipa/core',
'dojo/domReady!'
], function(app) {
app.run_simple('migrate');
});
});
ipa_loader.styles(styles);
ipa_loader.icons(icons);
})();
</script>
</head>
<body>
<noscript>This application requires JavaScript enabled.</noscript>
</body>
With debug logging enabled lots of log noise, anything particular stick out
such as:
SSL Library Error: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert
certificate unknown (SSL alert number 46)
or
File does not exist: /usr/share/ipa/ui/js/freeipa/menu.js
It sounds like menu.js might be important...
[Fri Feb 19 16:23:34.231671 2021] [core:debug] [pid 3423167:tid 3423380]
protocol.c(2338): [client x.x.x.x:34558] AH03155: select protocol from ,
choices=h2,http/1.1 for server ourserver.edu
[Fri Feb 19 16:23:34.238036 2021] [ssl:info] [pid 3423167:tid 3423377]
[client x.x.x.x:34560] AH02008: SSL library error 1 in handshake (server
ourserver.edu:443)
[Fri Feb 19 16:23:34.238088 2021] [ssl:info] [pid 3423167:tid 3423377] SSL
Library Error: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert
certificate unknown (SSL alert number 46)
[Fri Feb 19 16:23:34.238106 2021] [ssl:info] [pid 3423167:tid 3423377]
[client x.x.x.x:34560] AH01998: Connection closed to child 147 with
abortive shutdown (server ourserver.edu:443)
[Fri Feb 19 16:23:34.238350 2021] [ssl:info] [pid 3423167:tid 3423380]
[client x.x.x.x:34558] AH02008: SSL library error 1 in handshake (server
ourserver.edu:443)
[Fri Feb 19 16:23:34.238395 2021] [ssl:info] [pid 3423167:tid 3423380] SSL
Library Error: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert
certificate unknown (SSL alert number 46)
[Fri Feb 19 16:23:34.238443 2021] [ssl:info] [pid 3423167:tid 3423380]
[client x.x.x.x:34558] AH01998: Connection closed to child 150 with
abortive shutdown (server ourserver.edu:443)
[Fri Feb 19 16:23:34.239792 2021] [ssl:info] [pid 3423166:tid 3423299]
[client x.x.x.x:34562] AH01964: Connection to child 69 established (server
ourserver.edu:443)
[Fri Feb 19 16:23:34.240047 2021] [ssl:debug] [pid 3423166:tid 3423299]
ssl_engine_kernel.c(2374): [client x.x.x.x:34562] AH02043: SSL virtual host
for servername ourserver.edu found
[Fri Feb 19 16:23:34.240115 2021] [core:debug] [pid 3423166:tid 3423299]
protocol.c(2338): [client x.x.x.x:34562] AH03155: select protocol from ,
choices=h2,http/1.1 for server ourserver.edu
[Fri Feb 19 16:23:34.246809 2021] [ssl:debug] [pid 3423166:tid 3423299]
ssl_engine_kernel.c(2254): [client x.x.x.x:34562] AH02041: Protocol:
TLSv1.3, Cipher: TLS_AES_256_GCM_SHA384 (256/256 bits)
[Fri Feb 19 16:23:34.247008 2021] [socache_shmcb:debug] [pid 3423166:tid
3423299] mod_socache_shmcb.c(493): AH00831: socache_shmcb_store (0xf4 ->
subcache 20)
[Fri Feb 19 16:23:34.247037 2021] [socache_shmcb:debug] [pid 3423166:tid
3423299] mod_socache_shmcb.c(730): AH00842: expiring 1 and reclaiming 1
removed socache entries
[Fri Feb 19 16:23:34.247049 2021] [socache_shmcb:debug] [pid 3423166:tid
3423299] mod_socache_shmcb.c(750): AH00843: we now have 0 socache entries
[Fri Feb 19 16:23:34.247059 2021] [socache_shmcb:debug] [pid 3423166:tid
3423299] mod_socache_shmcb.c(847): AH00847: insert happened at idx=0,
data=(0:32)
[Fri Feb 19 16:23:34.247068 2021] [socache_shmcb:debug] [pid 3423166:tid
3423299] mod_socache_shmcb.c(850): AH00848: finished insert, subcache:
idx_pos/idx_used=0/1, data_pos/data_used=0/229
[Fri Feb 19 16:23:34.247077 2021] [socache_shmcb:debug] [pid 3423166:tid
3423299] mod_socache_shmcb.c(515): AH00834: leaving socache_shmcb_store
successfully
[Fri Feb 19 16:23:34.247269 2021] [socache_shmcb:debug] [pid 3423166:tid
3423299] mod_socache_shmcb.c(493): AH00831: socache_shmcb_store (0x7f ->
subcache 31)
[Fri Feb 19 16:23:34.247296 2021] [socache_shmcb:debug] [pid 3423166:tid
3423299] mod_socache_shmcb.c(730): AH00842: expiring 2 and reclaiming 0
removed socache entries
[Fri Feb 19 16:23:34.247306 2021] [socache_shmcb:debug] [pid 3423166:tid
3423299] mod_socache_shmcb.c(750): AH00843: we now have 0 socache entries
[Fri Feb 19 16:23:34.247315 2021] [socache_shmcb:debug] [pid 3423166:tid
3423299] mod_socache_shmcb.c(847): AH00847: insert happened at idx=0,
data=(0:32)
[Fri Feb 19 16:23:34.247324 2021] [socache_shmcb:debug] [pid 3423166:tid
3423299] mod_socache_shmcb.c(850): AH00848: finished insert, subcache:
idx_pos/idx_used=0/1, data_pos/data_used=0/229
[Fri Feb 19 16:23:34.247333 2021] [socache_shmcb:debug] [pid 3423166:tid
3423299] mod_socache_shmcb.c(515): AH00834: leaving socache_shmcb_store
successfully
[Fri Feb 19 16:23:34.248150 2021] [ssl:debug] [pid 3423166:tid 3423299]
ssl_engine_kernel.c(415): [client x.x.x.x:34562] AH02034: Initial (No.1)
HTTPS request received for child 69 (server ourserver.edu:443)
[Fri Feb 19 16:23:34.249128 2021] [deflate:debug] [pid 3423166:tid 3423299]
mod_deflate.c(867): [client x.x.x.x:34562] AH01384: Zlib: Compressed 1853
to 734 : URL /ipa/migration/index.html
[Fri Feb 19 16:23:34.519107 2021] [ssl:debug] [pid 3423166:tid 3423306]
ssl_engine_kernel.c(415): [client x.x.x.x:34562] AH02034: Subsequent (No.2)
HTTPS request received for child 76 (server ourserver.edu:443), referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:34.525342 2021] [ssl:debug] [pid 3423166:tid 3423295]
ssl_engine_kernel.c(415): [client x.x.x.x:34562] AH02034: Subsequent (No.3)
HTTPS request received for child 65 (server ourserver.edu:443), referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:34.526073 2021] [ssl:info] [pid 3423824:tid 3423866]
[client x.x.x.x:34566] AH01964: Connection to child 194 established (server
ourserver.edu:443)
[Fri Feb 19 16:23:34.526299 2021] [ssl:debug] [pid 3423824:tid 3423866]
ssl_engine_kernel.c(2374): [client x.x.x.x:34566] AH02043: SSL virtual host
for servername ourserver.edu found
[Fri Feb 19 16:23:34.526523 2021] [core:debug] [pid 3423824:tid 3423866]
protocol.c(2338): [client x.x.x.x:34566] AH03155: select protocol from ,
choices=h2,http/1.1 for server ourserver.edu
[Fri Feb 19 16:23:34.527712 2021] [ssl:info] [pid 3423167:tid 3423361]
[client x.x.x.x:34568] AH01964: Connection to child 131 established (server
ourserver.edu:443)
[Fri Feb 19 16:23:34.527908 2021] [ssl:debug] [pid 3423167:tid 3423361]
ssl_engine_kernel.c(2374): [client x.x.x.x:34568] AH02043: SSL virtual host
for servername ourserver.edu found
[Fri Feb 19 16:23:34.528093 2021] [core:debug] [pid 3423167:tid 3423361]
protocol.c(2338): [client x.x.x.x:34568] AH03155: select protocol from ,
choices=h2,http/1.1 for server ourserver.edu
[Fri Feb 19 16:23:34.528262 2021] [socache_shmcb:debug] [pid 3423824:tid
3423866] mod_socache_shmcb.c(555): AH00837: socache_shmcb_remove (0x7f ->
subcache 31)
[Fri Feb 19 16:23:34.528299 2021] [socache_shmcb:debug] [pid 3423824:tid
3423866] mod_socache_shmcb.c(939): AH00852: possible match at idx=0, data=0
[Fri Feb 19 16:23:34.528312 2021] [socache_shmcb:debug] [pid 3423824:tid
3423866] mod_socache_shmcb.c(944): AH00853: shmcb_subcache_remove removing
matching entry
[Fri Feb 19 16:23:34.528322 2021] [socache_shmcb:debug] [pid 3423824:tid
3423866] mod_socache_shmcb.c(570): AH00839: leaving socache_shmcb_remove
successfully
[Fri Feb 19 16:23:34.528338 2021] [ssl:info] [pid 3423824:tid 3423866]
[client x.x.x.x:34566] AH02008: SSL library error 1 in handshake (server
ourserver.edu:443)
[Fri Feb 19 16:23:34.528369 2021] [ssl:info] [pid 3423824:tid 3423866] SSL
Library Error: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert
certificate unknown (SSL alert number 46)
[Fri Feb 19 16:23:34.528383 2021] [ssl:info] [pid 3423824:tid 3423866]
[client x.x.x.x:34566] AH01998: Connection closed to child 194 with
abortive shutdown (server ourserver.edu:443)
[Fri Feb 19 16:23:34.528762 2021] [ssl:info] [pid 3423824:tid 3423871]
[client x.x.x.x:34570] AH01964: Connection to child 199 established (server
ourserver.edu:443)
[Fri Feb 19 16:23:34.529011 2021] [ssl:debug] [pid 3423824:tid 3423871]
ssl_engine_kernel.c(2374): [client x.x.x.x:34570] AH02043: SSL virtual host
for servername ourserver.edu found
[Fri Feb 19 16:23:34.529077 2021] [core:debug] [pid 3423824:tid 3423871]
protocol.c(2338): [client x.x.x.x:34570] AH03155: select protocol from ,
choices=h2,http/1.1 for server ourserver.edu
[Fri Feb 19 16:23:34.529562 2021] [socache_shmcb:debug] [pid 3423167:tid
3423361] mod_socache_shmcb.c(555): AH00837: socache_shmcb_remove (0xf4 ->
subcache 20)
[Fri Feb 19 16:23:34.529590 2021] [socache_shmcb:debug] [pid 3423167:tid
3423361] mod_socache_shmcb.c(939): AH00852: possible match at idx=0, data=0
[Fri Feb 19 16:23:34.529612 2021] [socache_shmcb:debug] [pid 3423167:tid
3423361] mod_socache_shmcb.c(944): AH00853: shmcb_subcache_remove removing
matching entry
[Fri Feb 19 16:23:34.529624 2021] [socache_shmcb:debug] [pid 3423167:tid
3423361] mod_socache_shmcb.c(570): AH00839: leaving socache_shmcb_remove
successfully
[Fri Feb 19 16:23:34.529642 2021] [ssl:info] [pid 3423167:tid 3423361]
[client x.x.x.x:34568] AH02008: SSL library error 1 in handshake (server
ourserver.edu:443)
[Fri Feb 19 16:23:34.529670 2021] [ssl:info] [pid 3423167:tid 3423361] SSL
Library Error: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert
certificate unknown (SSL alert number 46)
[Fri Feb 19 16:23:34.529684 2021] [ssl:info] [pid 3423167:tid 3423361]
[client x.x.x.x:34568] AH01998: Connection closed to child 131 with
abortive shutdown (server ourserver.edu:443)
[Fri Feb 19 16:23:34.531096 2021] [ssl:info] [pid 3423165:tid 3423230]
[client x.x.x.x:34572] AH01964: Connection to child 0 established (server
ourserver.edu:443)
[Fri Feb 19 16:23:34.531294 2021] [ssl:debug] [pid 3423165:tid 3423230]
ssl_engine_kernel.c(2374): [client x.x.x.x:34572] AH02043: SSL virtual host
for servername ourserver.edu found
[Fri Feb 19 16:23:34.531323 2021] [ssl:info] [pid 3423165:tid 3423240]
[client x.x.x.x:34574] AH01964: Connection to child 10 established (server
ourserver.edu:443)
[Fri Feb 19 16:23:34.531349 2021] [core:debug] [pid 3423165:tid 3423230]
protocol.c(2338): [client x.x.x.x:34572] AH03155: select protocol from ,
choices=h2,http/1.1 for server ourserver.edu
[Fri Feb 19 16:23:34.531487 2021] [ssl:debug] [pid 3423165:tid 3423240]
ssl_engine_kernel.c(2374): [client x.x.x.x:34574] AH02043: SSL virtual host
for servername ourserver.edu found
[Fri Feb 19 16:23:34.531538 2021] [core:debug] [pid 3423165:tid 3423240]
protocol.c(2338): [client x.x.x.x:34574] AH03155: select protocol from ,
choices=h2,http/1.1 for server ourserver.edu
[Fri Feb 19 16:23:34.535262 2021] [deflate:debug] [pid 3423166:tid 3423295]
mod_deflate.c(867): [client x.x.x.x:34562] AH01384: Zlib: Compressed 88090
to 30602 : URL /ipa/ui/js/libs/jquery.js, referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:34.535414 2021] [ssl:info] [pid 3423824:tid 3423871]
[client x.x.x.x:34570] AH02008: SSL library error 1 in handshake (server
ourserver.edu:443)
[Fri Feb 19 16:23:34.535467 2021] [ssl:info] [pid 3423824:tid 3423871] SSL
Library Error: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert
certificate unknown (SSL alert number 46)
[Fri Feb 19 16:23:34.535484 2021] [ssl:info] [pid 3423824:tid 3423871]
[client x.x.x.x:34570] AH01998: Connection closed to child 199 with
abortive shutdown (server ourserver.edu:443)
[Fri Feb 19 16:23:34.537555 2021] [ssl:info] [pid 3423824:tid 3423868]
[client x.x.x.x:34576] AH01964: Connection to child 196 established (server
ourserver.edu:443)
[Fri Feb 19 16:23:34.537726 2021] [ssl:debug] [pid 3423824:tid 3423868]
ssl_engine_kernel.c(2374): [client x.x.x.x:34576] AH02043: SSL virtual host
for servername ourserver.edu found
[Fri Feb 19 16:23:34.537781 2021] [core:debug] [pid 3423824:tid 3423868]
protocol.c(2338): [client x.x.x.x:34576] AH03155: select protocol from ,
choices=h2,http/1.1 for server ourserver.edu
[Fri Feb 19 16:23:34.538052 2021] [ssl:debug] [pid 3423165:tid 3423240]
ssl_engine_kernel.c(2254): [client x.x.x.x:34574] AH02041: Protocol:
TLSv1.3, Cipher: TLS_AES_256_GCM_SHA384 (256/256 bits)
[Fri Feb 19 16:23:34.538203 2021] [socache_shmcb:debug] [pid 3423165:tid
3423240] mod_socache_shmcb.c(493): AH00831: socache_shmcb_store (0x74 ->
subcache 20)
[Fri Feb 19 16:23:34.538223 2021] [socache_shmcb:debug] [pid 3423165:tid
3423240] mod_socache_shmcb.c(730): AH00842: expiring 0 and reclaiming 1
removed socache entries
[Fri Feb 19 16:23:34.538233 2021] [socache_shmcb:debug] [pid 3423165:tid
3423240] mod_socache_shmcb.c(750): AH00843: we now have 0 socache entries
[Fri Feb 19 16:23:34.538241 2021] [socache_shmcb:debug] [pid 3423165:tid
3423240] mod_socache_shmcb.c(847): AH00847: insert happened at idx=0,
data=(0:32)
[Fri Feb 19 16:23:34.538249 2021] [socache_shmcb:debug] [pid 3423165:tid
3423240] mod_socache_shmcb.c(850): AH00848: finished insert, subcache:
idx_pos/idx_used=0/1, data_pos/data_used=0/229
[Fri Feb 19 16:23:34.538258 2021] [socache_shmcb:debug] [pid 3423165:tid
3423240] mod_socache_shmcb.c(515): AH00834: leaving socache_shmcb_store
successfully
[Fri Feb 19 16:23:34.538428 2021] [socache_shmcb:debug] [pid 3423165:tid
3423240] mod_socache_shmcb.c(493): AH00831: socache_shmcb_store (0xfa ->
subcache 26)
[Fri Feb 19 16:23:34.538464 2021] [socache_shmcb:debug] [pid 3423165:tid
3423240] mod_socache_shmcb.c(730): AH00842: expiring 1 and reclaiming 0
removed socache entries
[Fri Feb 19 16:23:34.538494 2021] [socache_shmcb:debug] [pid 3423165:tid
3423240] mod_socache_shmcb.c(750): AH00843: we now have 0 socache entries
[Fri Feb 19 16:23:34.538505 2021] [socache_shmcb:debug] [pid 3423165:tid
3423240] mod_socache_shmcb.c(847): AH00847: insert happened at idx=0,
data=(0:32)
[Fri Feb 19 16:23:34.538498 2021] [ssl:debug] [pid 3423165:tid 3423230]
ssl_engine_kernel.c(2254): [client x.x.x.x:34572] AH02041: Protocol:
TLSv1.3, Cipher: TLS_AES_256_GCM_SHA384 (256/256 bits)
[Fri Feb 19 16:23:34.538514 2021] [socache_shmcb:debug] [pid 3423165:tid
3423240] mod_socache_shmcb.c(850): AH00848: finished insert, subcache:
idx_pos/idx_used=0/1, data_pos/data_used=0/229
[Fri Feb 19 16:23:34.538537 2021] [socache_shmcb:debug] [pid 3423165:tid
3423240] mod_socache_shmcb.c(515): AH00834: leaving socache_shmcb_store
successfully
[Fri Feb 19 16:23:34.538701 2021] [socache_shmcb:debug] [pid 3423165:tid
3423230] mod_socache_shmcb.c(493): AH00831: socache_shmcb_store (0xbf ->
subcache 31)
[Fri Feb 19 16:23:34.538730 2021] [socache_shmcb:debug] [pid 3423165:tid
3423230] mod_socache_shmcb.c(730): AH00842: expiring 0 and reclaiming 1
removed socache entries
[Fri Feb 19 16:23:34.538742 2021] [socache_shmcb:debug] [pid 3423165:tid
3423230] mod_socache_shmcb.c(750): AH00843: we now have 0 socache entries
[Fri Feb 19 16:23:34.538751 2021] [socache_shmcb:debug] [pid 3423165:tid
3423230] mod_socache_shmcb.c(847): AH00847: insert happened at idx=0,
data=(0:32)
[Fri Feb 19 16:23:34.538760 2021] [socache_shmcb:debug] [pid 3423165:tid
3423230] mod_socache_shmcb.c(850): AH00848: finished insert, subcache:
idx_pos/idx_used=0/1, data_pos/data_used=0/228
[Fri Feb 19 16:23:34.538769 2021] [socache_shmcb:debug] [pid 3423165:tid
3423230] mod_socache_shmcb.c(515): AH00834: leaving socache_shmcb_store
successfully
[Fri Feb 19 16:23:34.538941 2021] [socache_shmcb:debug] [pid 3423165:tid
3423230] mod_socache_shmcb.c(493): AH00831: socache_shmcb_store (0x1d ->
subcache 29)
[Fri Feb 19 16:23:34.538979 2021] [socache_shmcb:debug] [pid 3423165:tid
3423230] mod_socache_shmcb.c(730): AH00842: expiring 1 and reclaiming 0
removed socache entries
[Fri Feb 19 16:23:34.538990 2021] [socache_shmcb:debug] [pid 3423165:tid
3423230] mod_socache_shmcb.c(750): AH00843: we now have 0 socache entries
[Fri Feb 19 16:23:34.539000 2021] [socache_shmcb:debug] [pid 3423165:tid
3423230] mod_socache_shmcb.c(847): AH00847: insert happened at idx=0,
data=(0:32)
[Fri Feb 19 16:23:34.539008 2021] [socache_shmcb:debug] [pid 3423165:tid
3423230] mod_socache_shmcb.c(850): AH00848: finished insert, subcache:
idx_pos/idx_used=0/1, data_pos/data_used=0/228
[Fri Feb 19 16:23:34.539017 2021] [socache_shmcb:debug] [pid 3423165:tid
3423230] mod_socache_shmcb.c(515): AH00834: leaving socache_shmcb_store
successfully
[Fri Feb 19 16:23:34.541010 2021] [ssl:debug] [pid 3423165:tid 3423240]
ssl_engine_kernel.c(415): [client x.x.x.x:34574] AH02034: Initial (No.1)
HTTPS request received for child 10 (server ourserver.edu:443), referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:34.541165 2021] [ssl:debug] [pid 3423165:tid 3423230]
ssl_engine_kernel.c(415): [client x.x.x.x:34572] AH02034: Initial (No.1)
HTTPS request received for child 0 (server ourserver.edu:443), referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:34.541781 2021] [ssl:debug] [pid 3423166:tid 3423298]
ssl_engine_kernel.c(415): [client x.x.x.x:34562] AH02034: Subsequent (No.4)
HTTPS request received for child 68 (server ourserver.edu:443), referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:34.542289 2021] [deflate:debug] [pid 3423165:tid 3423230]
mod_deflate.c(867): [client x.x.x.x:34572] AH01384: Zlib: Compressed 8147
to 2293 : URL /ipa/ui/css/ipa.css, referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:34.542837 2021] [deflate:debug] [pid 3423166:tid 3423298]
mod_deflate.c(867): [client x.x.x.x:34562] AH01384: Zlib: Compressed 8809
to 2459 : URL /ipa/ui/ipa.css, referer: https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:34.544983 2021] [ssl:debug] [pid 3423824:tid 3423868]
ssl_engine_kernel.c(2254): [client x.x.x.x:34576] AH02041: Protocol:
TLSv1.3, Cipher: TLS_AES_256_GCM_SHA384 (256/256 bits)
[Fri Feb 19 16:23:34.545144 2021] [socache_shmcb:debug] [pid 3423824:tid
3423868] mod_socache_shmcb.c(493): AH00831: socache_shmcb_store (0xbb ->
subcache 27)
[Fri Feb 19 16:23:34.545169 2021] [socache_shmcb:debug] [pid 3423824:tid
3423868] mod_socache_shmcb.c(730): AH00842: expiring 0 and reclaiming 1
removed socache entries
[Fri Feb 19 16:23:34.545180 2021] [socache_shmcb:debug] [pid 3423824:tid
3423868] mod_socache_shmcb.c(750): AH00843: we now have 0 socache entries
[Fri Feb 19 16:23:34.545188 2021] [socache_shmcb:debug] [pid 3423824:tid
3423868] mod_socache_shmcb.c(847): AH00847: insert happened at idx=0,
data=(0:32)
[Fri Feb 19 16:23:34.545196 2021] [socache_shmcb:debug] [pid 3423824:tid
3423868] mod_socache_shmcb.c(850): AH00848: finished insert, subcache:
idx_pos/idx_used=0/1, data_pos/data_used=0/229
[Fri Feb 19 16:23:34.545204 2021] [socache_shmcb:debug] [pid 3423824:tid
3423868] mod_socache_shmcb.c(515): AH00834: leaving socache_shmcb_store
successfully
[Fri Feb 19 16:23:34.545360 2021] [socache_shmcb:debug] [pid 3423824:tid
3423868] mod_socache_shmcb.c(493): AH00831: socache_shmcb_store (0xae ->
subcache 14)
[Fri Feb 19 16:23:34.545397 2021] [socache_shmcb:debug] [pid 3423824:tid
3423868] mod_socache_shmcb.c(730): AH00842: expiring 2 and reclaiming 0
removed socache entries
[Fri Feb 19 16:23:34.545407 2021] [socache_shmcb:debug] [pid 3423824:tid
3423868] mod_socache_shmcb.c(750): AH00843: we now have 0 socache entries
[Fri Feb 19 16:23:34.545416 2021] [socache_shmcb:debug] [pid 3423824:tid
3423868] mod_socache_shmcb.c(847): AH00847: insert happened at idx=0,
data=(0:32)
[Fri Feb 19 16:23:34.545424 2021] [socache_shmcb:debug] [pid 3423824:tid
3423868] mod_socache_shmcb.c(850): AH00848: finished insert, subcache:
idx_pos/idx_used=0/1, data_pos/data_used=0/228
[Fri Feb 19 16:23:34.545432 2021] [socache_shmcb:debug] [pid 3423824:tid
3423868] mod_socache_shmcb.c(515): AH00834: leaving socache_shmcb_store
successfully
[Fri Feb 19 16:23:34.552996 2021] [deflate:debug] [pid 3423165:tid 3423240]
mod_deflate.c(867): [client x.x.x.x:34574] AH01384: Zlib: Compressed 201946
to 31837 : URL /ipa/ui/css/patternfly.css, referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:34.567942 2021] [ssl:debug] [pid 3423165:tid 3423244]
ssl_engine_kernel.c(415): [client x.x.x.x:34574] AH02034: Subsequent (No.2)
HTTPS request received for child 14 (server ourserver.edu:443), referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:34.568753 2021] [deflate:debug] [pid 3423165:tid 3423244]
mod_deflate.c(867): [client x.x.x.x:34574] AH01384: Zlib: Compressed 4425
to 1337 : URL /ipa/ui/js/libs/jquery.ordered-map.js, referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:35.712960 2021] [ssl:debug] [pid 3423165:tid 3423239]
ssl_engine_kernel.c(415): [client x.x.x.x:34574] AH02034: Subsequent (No.3)
HTTPS request received for child 9 (server ourserver.edu:443), referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:35.728347 2021] [deflate:debug] [pid 3423165:tid 3423239]
mod_deflate.c(867): [client x.x.x.x:34574] AH01384: Zlib: Compressed 142079
to 41307 : URL /ipa/ui/js/dojo/dojo.js, referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:35.757444 2021] [ssl:debug] [pid 3423165:tid 3423241]
ssl_engine_kernel.c(415): [client x.x.x.x:34574] AH02034: Subsequent (No.4)
HTTPS request received for child 11 (server ourserver.edu:443), referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:35.788804 2021] [deflate:debug] [pid 3423165:tid 3423241]
mod_deflate.c(867): [client x.x.x.x:34574] AH01384: Zlib: Compressed 353973
to 79203 : URL /ipa/ui/js/freeipa/core.js, referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:35.850989 2021] [ssl:debug] [pid 3423165:tid 3423236]
ssl_engine_kernel.c(415): [client x.x.x.x:34574] AH02034: Subsequent (No.5)
HTTPS request received for child 6 (server ourserver.edu:443), referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:35.851240 2021] [authz_core:debug] [pid 3423165:tid
3423236] mod_authz_core.c(815): [client x.x.x.x:34574] AH01626:
authorization result of Require all granted: granted, referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:35.851266 2021] [authz_core:debug] [pid 3423165:tid
3423236] mod_authz_core.c(815): [client x.x.x.x:34574] AH01626:
authorization result of <RequireAny>: granted, referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:35.851657 2021] [authz_core:debug] [pid 3423165:tid
3423236] mod_authz_core.c(815): [client x.x.x.x:34574] AH01626:
authorization result of Require all granted: granted, referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:35.851685 2021] [authz_core:debug] [pid 3423165:tid
3423236] mod_authz_core.c(815): [client x.x.x.x:34574] AH01626:
authorization result of <RequireAny>: granted, referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:35.851706 2021] [auth_gssapi:debug] [pid 3423165:tid
3423236] mod_auth_gssapi.c(737): [client x.x.x.x:34574] GSSapiImpersonate
not On, skipping impersonation., referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:35.852504 2021] [wsgi:error] [pid 3423161:tid 3423516]
[remote x.x.x.x:34574] ipa: DEBUG: WSGI wsgi_dispatch.__call__:
[Fri Feb 19 16:23:35.852742 2021] [wsgi:error] [pid 3423161:tid 3423516]
[remote x.x.x.x:34574] ipa: DEBUG: WSGI jsonserver_i18n_messages.__call__:
[Fri Feb 19 16:23:35.853047 2021] [wsgi:error] [pid 3423161:tid 3423516]
[remote x.x.x.x:34574] ipa: DEBUG: WSGI jsonserver.__call__:
[Fri Feb 19 16:23:35.853182 2021] [wsgi:error] [pid 3423161:tid 3423516]
[remote x.x.x.x:34574] ipa: DEBUG: WSGI WSGIExecutioner.__call__:
[Fri Feb 19 16:23:35.853590 2021] [wsgi:error] [pid 3423161:tid 3423516]
[remote x.x.x.x:34574] ipa: DEBUG: raw: i18n_messages(version='2.240')
[Fri Feb 19 16:23:35.853829 2021] [wsgi:error] [pid 3423161:tid 3423516]
[remote x.x.x.x:34574] ipa: DEBUG: i18n_messages(version='2.240')
[Fri Feb 19 16:23:35.862845 2021] [wsgi:error] [pid 3423161:tid 3423516]
[remote x.x.x.x:34574] ipa: INFO: [jsonserver_i18n_messages] UNKNOWN:
i18n_messages(version='2.240'): SUCCESS
[Fri Feb 19 16:23:35.873590 2021] [deflate:debug] [pid 3423165:tid 3423236]
mod_deflate.c(867): [client x.x.x.x:34574] AH01384: Zlib: Compressed 74510
to 14081 : URL /ipa/i18n_messages, referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:35.896395 2021] [ssl:debug] [pid 3423165:tid 3423245]
ssl_engine_kernel.c(415): [client x.x.x.x:34574] AH02034: Subsequent (No.6)
HTTPS request received for child 15 (server ourserver.edu:443), referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:35.897876 2021] [deflate:debug] [pid 3423165:tid 3423245]
mod_deflate.c(867): [client x.x.x.x:34574] AH01384: Zlib: Compressed 69 to
71 : URL /ipa/wsgi/plugins.py, referer: https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:36.380770 2021] [ssl:debug] [pid 3423165:tid 3423246]
ssl_engine_kernel.c(415): [client x.x.x.x:34574] AH02034: Subsequent (No.7)
HTTPS request received for child 16 (server ourserver.edu:443), referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:36.381518 2021] [deflate:debug] [pid 3423165:tid 3423246]
mod_deflate.c(867): [client x.x.x.x:34574] AH01384: Zlib: Compressed 3120
to 799 : URL /ipa/ui/js/plugins/userfas/userfas.js, referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:36.381532 2021] [ssl:debug] [pid 3423166:tid 3423297]
ssl_engine_kernel.c(415): [client x.x.x.x:34562] AH02034: Subsequent (No.5)
HTTPS request received for child 67 (server ourserver.edu:443), referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:36.382464 2021] [ssl:debug] [pid 3423165:tid 3423253]
ssl_engine_kernel.c(415): [client x.x.x.x:34572] AH02034: Subsequent (No.2)
HTTPS request received for child 23 (server ourserver.edu:443), referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:36.382510 2021] [deflate:debug] [pid 3423166:tid 3423297]
mod_deflate.c(867): [client x.x.x.x:34562] AH01384: Zlib: Compressed 4580
to 1251 : URL /ipa/ui/js/plugins/groupfas/groupfas.js, referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:36.383392 2021] [deflate:debug] [pid 3423165:tid 3423253]
mod_deflate.c(867): [client x.x.x.x:34572] AH01384: Zlib: Compressed 5255
to 1061 : URL /ipa/ui/js/plugins/fasagreement/fasagreement.js, referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:36.390937 2021] [ssl:debug] [pid 3423165:tid 3423254]
ssl_engine_kernel.c(415): [client x.x.x.x:34572] AH02034: Subsequent (No.3)
HTTPS request received for child 24 (server ourserver.edu:443), referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:36.391264 2021] [core:info] [pid 3423165:tid 3423254]
[client x.x.x.x:34572] AH00128: File does not exist:
/usr/share/ipa/ui/js/freeipa/menu.js, referer:
https://ourserver.edu/ipa/migration/
[Fri Feb 19 16:23:36.391307 2021] [headers:debug] [pid 3423165:tid 3423254]
mod_headers.c(899): AH01503: headers: ap_headers_error_filter()
[Fri Feb 19 16:23:54.565642 2021] [reqtimeout:info] [pid 3423824:tid
3423868] [client x.x.x.x:34576] AH01382: Request header read timeout
[Fri Feb 19 16:23:54.565889 2021] [ssl:debug] [pid 3423824:tid 3423868]
ssl_engine_io.c(1102): [client x.x.x.x:34576] AH02001: Connection closed to
child 196 with standard shutdown (server ourserver.edu:443)
[Fri Feb 19 16:24:06.382971 2021] [ssl:debug] [pid 3423165:tid 3423238]
ssl_engine_io.c(1102): [client x.x.x.x:34574] AH02001: Connection closed to
child 8 with standard shutdown (server ourserver.edu:443)
[Fri Feb 19 16:24:06.384886 2021] [ssl:debug] [pid 3423166:tid 3423294]
ssl_engine_io.c(1102): [client x.x.x.x:34562] AH02001: Connection closed to
child 64 with standard shutdown (server ourserver.edu:443)
[Fri Feb 19 16:24:06.391593 2021] [ssl:debug] [pid 3423165:tid 3423250]
ssl_engine_io.c(1102): [client x.x.x.x:34572] AH02001: Connection closed to
child 20 with standard shutdown (server ourserver.edu:443)
1 year, 4 months