June 2021 - FreeIPA-users - Fedora mailing-lists

Join command 500 errors, timeouts
by Alfred Victor 22 Jun '21

22 Jun '21

Hi FreeIPA list, We are having an issue with our IPA environment of 4 replicated FreeIPA systems serving linux compute clients which join from a command in rc.local after boot. This worked in the past, but the system has been rebuilt since and the join command changed slightly. Unfortunately booting a few dozen nodes at a time, though they each talk to a different IPA system by design, leads to problems such as these - though 40-100 nodes can boot ok at a time there are always many stragglers, and the more we attempt to boot at once the more fail to join IPA (if we try to boot 500 nodes, we are lucky if we get a fifth of that joining IPA). Can you please advise on this output? Here is our join command in compute node rc.local: ipa-client-install -U -q -p mach_join \ > -w <redacted> \ > --force-join \ > --no-dns-sshfp \ > --automount-location=redacted-node And here is some log output of the 500 error: ProtocolError: <ProtocolError for redacted.redacted.com/ipa/json: 500 Internal Server Error> > Cannot connect to the server due to generic error: cannot connect to 'https://redacted.redacted.com/ipa/json <https://hauth0003.dug.com/ipa/json>': Internal Server Error > > As well as: 2021-06-02T21:39:11Z DEBUG Starting external process > 2021-06-02T21:39:11Z DEBUG args=/usr/sbin/ipa-join -s > redacted.redacted.com -b dc=redacted,dc=com -h redactednode.redacted.com > -f > 2021-06-02T21:40:13Z DEBUG Process finished, return code=17 > 2021-06-02T21:40:13Z DEBUG stdout= > 2021-06-02T21:40:13Z DEBUG stderr=HTTP response code is 500, not 200 > 2021-06-02T21:40:13Z ERROR Joining realm failed: HTTP response code is > 500, not 200 And we also see timeouts happen: > > 2021-06-02T22:08:50Z DEBUG args=/usr/sbin/ipa-join -s redacted.redacted.com -b dc=redacted,dc=com -h redactednode.redacted.com -f > 2021-06-02T22:09:01Z DEBUG Process finished, return code=17 > 2021-06-02T22:09:01Z DEBUG stdout= > 2021-06-02T22:09:01Z DEBUG stderr=RPC failed at server. Configured time limit exceeded > 2021-06-02T22:09:01Z ERROR Joining realm failed: RPC failed at server. Configured time limit exceeded And we also see later timeouts near the end of the log in some cases though are able to authenticate and it didn't back out the install, but never got going healthy either: > > 2021-06-03T19:20:13Z DEBUG The ipa-client-install command failed, > exception: TimeLimitExceeded: Configured time limit exceeded Donald

4 21

ipactl status hangs
by Ronald Wimmer 21 Jun '21

21 Jun '21

On some servers I can see that ipactl status hangs from time to time. I can see SSSD reporting the backend to be offline and dirsrv not running for some reason. ipactl -d status reveals that it hangs when issuing systemctl is-active dirsrv. Instead of hanging I would expect ipcactl status to report a problem (= dirsrv not running). Cheers, Ronald

2 2

sssd version 2.2.3 issues with AD Trust View
by iulian roman 18 Jun '21

18 Jun '21

Hello everybody, I have an IPA setup with AD trust configured and Trust View defined on the IPA server. Everything works properly on Ubuntu 18 clients with sssd 1.16.1 but it doesn't on Ubuntu 20 with sssd version 2.2.3. I can list /query the AD accounts which are not part of the default Trust View, but not those accounts which have the id overriden in the Trust View. Is that a known issue, or any idea what do I need to change /where to look ?

2 4

Consumer failed to replay change Operations error (1)
by Alfred Victor 17 Jun '21

17 Jun '21

Hi FreeIPA, We have some replication messages in our slapd errors log which look very like the ones discussed here: https://bugzilla.redhat.com/show_bug.cgi?id=1574602 I took a look and we do have the MemberOf plugin, but our version of 389-ds newer: *389-ds-base-1.3.10.2-10.el7_9.x86_64* Hoping someone might have a suggestion for what we might do to get rid of these log messages, or what the root cause may be/impact? They've been going since at least a couple of weeks ago: [15/Jun/2021:18:57:26.362094959 -0500] - WARN - NSMMReplicationPlugin - repl5_inc_update_from_op_result - agmt="cn=redactedauth0001.redacted.com-to-redactedauth0003.redacted.com" (redactedauth0003:389): Consumer failed to replay change (uniqueid d5896001-39a111eb-8868efc8-91dc0b98, CSN 60c93bc2000400250000): Operations error (1). Will retry later. I looked for this same uniqueid (they are ALL the same uniqueID) and found this which is interesting and references a specific cn and "optype": > > [03/Jun/2021:15:45:43.332068775 -0500] - ERR - NSMMReplicationPlugin - write_changelog_and_ruv - Can't add a change for cn=admin,cn=groups,cn=accounts,dc=redacted,dc=com (uniqid: d5896001-39a111eb-8868efc8-91dc0b98, optype: 8) to changelog csn 60b93f93005200230000 Alfred

3 2

IPA RA expired, other certificates renewed
by Jan Bundesmann 16 Jun '21

16 Jun '21

Hi there, I need some suggestions for a certificate related problem. The setup has 2 servers, let's call them ldap1 and ldap2 with ldap1 being the primary system with the CA. The certificates were to expire on june 15. I checked on june 1st and on ldap1 certmonger had renewed all certificates, on ldap2 certmonger was not running. So, I restarted the certmonger service and it began its work. `getcert list` shows three certificates (it's ipa 4.4, so that's probably correct) Quite soon, the first certificate was renewed (HTTP/ldap2, ...) I assume that's the one for the web UI. A second one (ldap/ldap2...) is still valid until december. I assume that's why all the ldap related stuff and replication is still working. But the cn=IPA RA expired one week ago (may 24th). I have no ipa-certs-fix, would setting back the system clock still work? The HTTP/ldap2 certificate was not yet valid when the IPA RA certificate expired. Or put the the other round: what happens if i don't renew this certificate - that's not quite clear to me. Currently, the system ist working fine, replication works and in 2022 the hardware will be replaced, so we will setup new replicas anyways. But, that's after the expiration date of the ldap/ldap2 certificate. I hope this is understandable and thanks in advance for any hint.

2 7

Doc suggestion: explicitly advise 'non-desktop' spins for freeipa-server*
by Harry G. Coin 15 Jun '21

15 Jun '21

Might the 'edition' (server, desktop, iot, whatnot) of the distribution used in testing freeipa-server* be explicitly stated in the 'getting started' docs as being 'approved' for freeipa-server use? The better to avoid interactions with un-interaction-tested packages / security libraries generally seen only in user/special-purpose distros. (re: dnssec / bind9 / smart-card interaction) HC

1 0

AD Trust Types
by Ronald Wimmer 15 Jun '21

15 Jun '21

Quite some time ago I added a trust to another AD domain. IIRC I added an "external trust" for a reason I do not remember. What is the "Non-transitive external trust to a domain in another Active Directory forest" trust type for? Could I not just have added another "Active Directory domain" trust? Any clarification on this matter would be highly appreciated! Cheers, Ronald

3 9

FreeIPA 4.9.4 and 4.9.5 released
by Alexander Bokovoy 14 Jun '21

14 Jun '21

The FreeIPA team would like to announce FreeIPA 4.9.4 and 4.9.5 releases! Yes, this is not a mistake. First we created FreeIPA 4.9.4 on June 4th but then found a late time regression that took us more than ten days to sort out, thus going with the FreeIPA 4.9.5 release. This regression concerns an edge case of an unauthenticated or almost expired user credential's run of 'ipa' command line tool returning a non-processed Python exception instead of a human-readable error message. This, in turn uncovered a bit of a misconfiguration on the IPA server side which could trigger this behavior. In a process of investigating it we also found a bug in GSS-Proxy tool. FreeIPA 4.9.4 release notes are large and can be found at https://www.freeipa.org/page/Releases/4.9.4 FreeIPA 4.9.5 is released and can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. FreeIPA installation is currently broken in Fedora Rawhide due to an ongoing migration to Python 3.10 in Fedora where mod_wsgi does not yet support Python 3.10. == Highlights in 4.9.5 === Bug fixes FreeIPA 4.9.5 is a stabilization release for the features delivered as a part of 4.9.0 version series. There are 7 bug-fixes since FreeIPA 4.9.4 release. Details of the bug-fixes can be seen in the list of resolved tickets below. == Upgrading Upgrade instructions are available on Upgrade page. == Feedback Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets * https://pagure.io/freeipa/issue/8691[#8691] [Tracker] Nightly failure (fc33) in test_winsyncmigrate.py: ipa-replica-manage connect --winsync error * https://pagure.io/freeipa/issue/8702[#8702] (https://bugzilla.redhat.com/show_bug.cgi?id=1780317[rhbz#1780317]) ipa-cert-fix: False Positive Status for cert renewal. * https://pagure.io/freeipa/issue/8756[#8756] [Tracker] 389ds coredump in test_caless.py::TestReplicaInstall::test_wildcard_http * https://pagure.io/freeipa/issue/8868[#8868] Nightly test failure in test_integration/test_fips.py::TestInstallFIPS * https://pagure.io/freeipa/issue/8873[#8873] Missing credential cache can raise 500 when authenticating instead of 401 * https://pagure.io/freeipa/issue/8876[#8876] Nightly failure in test_installation.py::TestInstallWithCA1::test_install_with_bad_ldap_conf * https://pagure.io/freeipa/issue/8877[#8877] Nightly test failure in test_nfs.py: runner VM runs out of disk space due to huge sssd log file == Detailed changelog since 4.9.4 === Armando Neto (1) * ipatests: Bump PR-CI boxes https://pagure.io/freeipa/c/79e0919132adf0df764400f9c27268cbadd2578b[commit] === Alexander Bokovoy (3) * Become FreeIPA 4.9.5 https://pagure.io/freeipa/c/e045f118c87346bfab5b5634fd23f3054f082f7f[commit] * get_credentials: return ValueError for missing creds https://pagure.io/freeipa/c/5238651da06547bb004de2434ae7d357422ba735[commit] https://pagure.io/freeipa/issue/8873[#8873] * Back to git snapshots https://pagure.io/freeipa/c/b25f5bd9109b87916e097dd8353ea5f0dc49e398[commit] === Florence Blanc-Renaud (4) * ipa-cert-fix man page: add note about certmonger renewal https://pagure.io/freeipa/c/06a445aff10c1ab84e8784ab41b0a838e500e617[commit] https://pagure.io/freeipa/issue/8702[#8702] * freeipa.spec: bump 389-ds version https://pagure.io/freeipa/c/6eb535334d33f8f375b856e3a2d0b8853b318b4d[commit] https://pagure.io/freeipa/issue/8691[#8691], https://pagure.io/freeipa/issue/8756[#8756] * ipatests: delete the replica before uninstallation https://pagure.io/freeipa/c/2b22450dfdc1657b463683b09b9c69816f9152d9[commit] https://pagure.io/freeipa/issue/8876[#8876] * ipatests: set selinux context for fips mode https://pagure.io/freeipa/c/13b257d7a05fd255df472144712edb34604dbe06[commit] https://pagure.io/freeipa/issue/8868[#8868] === Stanislav Levin (2) * gssproxy: Don't refresh expired delegated credentials https://pagure.io/freeipa/c/0fd06f33b83aec19a88c594d3750bc476157ab83[commit] * krb_utils: Simplify get_credentials https://pagure.io/freeipa/c/700be74975cad998e7dbcc4fb437e6b0bbd77305[commit] https://pagure.io/freeipa/issue/8873[#8873] === Sergey Orlov (2) * ipatests: disable test_nfs.py::TestNFS in nightly runs on Fedora 33 https://pagure.io/freeipa/c/c9f5acc0d281f1a27471091648c36f94528c5a29[commit] https://pagure.io/freeipa/issue/8877[#8877] * ipatests: temporary disable execution of test_nfs.py::TestNFS in nightly runs https://pagure.io/freeipa/c/6ee14f513711ae9be799cfa2bd009f13c5248932[commit] https://pagure.io/freeipa/issue/8877[#8877] -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland _______________________________________________ FreeIPA-devel mailing list -- freeipa-devel(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-devel-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-devel@lists.fedorahost… Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

1 0

DNS Locations and external DNS
by Ronald Wimmer 14 Jun '21

14 Jun '21

Is it sufficient to create DNS locations in IPA and do a ipa dns-update-system-records --dry-run in order to populate new DNS Zone information to the external DNS system? Apart from adding IPA clients to their respective locations, there is nothing to do regarding DNS locations on IPA clients, right? Cheers, Ronald

2 2

Cant login via AD user
by Konstantin Ignatev 13 Jun '21

13 Jun '21

Good day. IPA - 4.9.4. OS - Fedora 34. I have established a trust relationship with the AD domain. The list of domains is easily obtained by the command ipa trust-fetch-domains "example.com" I can get a ticket using kinit username(a)example.com in CLI. I can not log into the server using the AD account from UI. With exactly the same installation but on the Centos 7 + IPA 4.6.8 there are no similar problemsю In /var/log/httpd/error_log [Sun Jun 13 15:51:14.045718 2021] [wsgi:error] [pid 2312:tid 2815] [remote 172.17.51.252:8946] ipa: INFO: 401 Unauthorized: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2598844988): KDC returned error string: PROCESS_TGS In /var/log/krb5kdc.log Jun 13 15:51:13 freeipa-master.ipa.example.com krb5kdc[2256](info): AS_REQ (3 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23)}) 172.17.252.121: REFERRAL: aduser\@example.com@IPA.EXAMPLE.COM for krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM, Realm not local to KDC /etc/krb.conf includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = IPA.EXAMPLE.COM dns_lookup_realm = false dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} default_tkt_enctypes = aes256-cts aes128-cts rc4-hmac arcfour-hmac-md5 des-cbc-md5 des-cbc-crc [realms] IPA.EXAMPLE.COM = { kdc = freeipa-master.ipa.example.com:88 master_kdc = freeipa-master.ipa.example.com:88 admin_server = freeipa-master.ipa.example.com:749 default_domain = ipa.example.com pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem auth_to_local = RULE:[1:$1@$0](^.*@EXAMPLE.COM$)s/@EXAMPLE.COM/@example.com/ auth_to_local = DEFAULT } [domain_realm] .ipa.example.com = IPA.EXAMPLE.COM ipa.example.com = IPA.EXAMPLE.COM freeipa-master.ipa.example.com = IPA.EXAMPLE.COM [dbmodules] IPA.EXAMPLE.COM = { db_library = ipadb.so } [plugins] certauth = { module = ipakdb:kdb/ipadb.so enable_only = ipakdb } /etc/sssd/sssd.conf [domain/ipa.example.com] krb5_use_kdcinfo = False krb5_use_fast = never id_provider = ipa ipa_server_mode = True ipa_server = freeipa-master.ipa.example.com ipa_domain = ipa.example.com ipa_hostname = freeipa-master.ipa.example.com auth_provider = ipa chpass_provider = ipa access_provider = ipa cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True [sssd] services = nss, pam, ifp, ssh, sudo domains = ipa.example.com [nss] homedir_substring = /home memcache_timeout = 600 [pam] [sudo] [autofs] [ssh] [pac] [ifp] allowed_uids = ipaapi, root [secrets] [session_recording] I would be grateful for any help

2 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users June 2021