Adding SAML2 & OIDC
by Ciro Iriarte
Hello,
I'm looking forward to add 2FA, SAML2 & OIDC interfaces to my
authentication services running on FreeIPA. Are there any recommended
integrations?.
I'm thinking about implementing Authelia or Keycloak. My main concern is
the first forced password change & following password expirations (should
not be able to proceed without changing password and yet be able to change
it). Would pretty much prefer "self service" by the end user.
Regards,
CI.-
2 years, 6 months
FreeIPA LDAP Apache Basic Auth
by Thorsten Johannsen
Hi,
I'm pulling my hair with FreeIPA and Apache BasicAuth LDAP.
I have an application behind an Apache reverse Proxy that I want to
"protect" with LDAP Authentification.
This is the (redacted) apache configuration:
--------------------------------------------------------------------------------------
<VirtualHost *:443>
ServerName acme.server.org
ProxyRequests Off
ProxyPreserveHost On
# Auth changes in 2.4 - see
http://httpd.apache.org/docs/2.4/upgrading.html#run-time
<Proxy *>
#Require all granted
</Proxy>
<Location /admin>
Order Deny,Allow
Deny from all
Allow from 10.66.38.0/24
</Location>
ProxyPass / http://INTSERVER:1234/
ProxyPassReverse / http://INTSERVER:1234/
Loglevel ldap_module:debug
Loglevel auth_basic:debug
Loglevel authz_core:debug
<Location />
Options Indexes FollowSymlinks
AuthType Basic
AuthBasicProvider ldap
AuthName "ACME AUTHENTICATION"
AuthLDAPURL
ldap://ipa2.internal.lan/cn=users,cn=accounts,dc=internal,dc=lan?uid?sub
AuthLDAPBindDN
uid=s_ldapquery,cn=sysaccounts,cn=etc,dc=internal,dc=lan
AuthLDAPBindPassword XXXXXXXXXXXXXXXXXXXXX
Require valid-user
</Location>
SSLCertificateFile /etc/letsencrypt/live/XXXX/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/XXXX/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateChainFile /etc/letsencrypt/live/XXXX/chain.pem
</VirtualHost>
--------------------------------------------------------------------------------------
The Bind-User "s_ldapquery" is working fine, passwords tripple checked
and used with other LDAP integrations.
When authenticating, apache logs show:
[Sat Sep 25 18:40:25.891588 2021] [authz_core:debug] [pid 414]
mod_authz_core.c(809): [client 1.2.3.4:52628] AH01626: authorization
result of Require valid-user : denied (no authenticated user yet)
[Sat Sep 25 18:40:25.891683 2021] [authz_core:debug] [pid 414]
mod_authz_core.c(809): [client 1.2.3.4:52628] AH01626: authorization
result of <RequireAny>: denied (no authenticated user yet)
[Sat Sep 25 18:40:35.786942 2021] [authz_core:debug] [pid 413]
mod_authz_core.c(809): [client 1.2.3.4:52629] AH01626: authorization
result of Require valid-user : denied (no authenticated user yet)
[Sat Sep 25 18:40:35.787025 2021] [authz_core:debug] [pid 413]
mod_authz_core.c(809): [client 1.2.3.4:52629] AH01626: authorization
result of <RequireAny>: denied (no authenticated user yet)
[Sat Sep 25 18:40:36.028473 2021] [ldap:debug] [pid 413]
util_ldap.c(379): AH01278: LDAP: Setting referrals to On.
[Sat Sep 25 18:40:36.210906 2021] [authz_core:debug] [pid 413]
mod_authz_core.c(809): [client 1.2.3.4:52629] AH01626: authorization
result of Require valid-user : granted
[Sat Sep 25 18:40:36.210987 2021] [authz_core:debug] [pid 413]
mod_authz_core.c(809): [client 1.2.3.4:52629] AH01626: authorization
result of <RequireAny>: granted
[Sat Sep 25 18:40:36.300669 2021] [authz_core:debug] [pid 413]
mod_authz_core.c(809): [client 1.2.3.4:52629] AH01626: authorization
result of Require valid-user : denied (no authenticated user yet),
referer: https://acme.server.org/
[Sat Sep 25 18:40:36.300749 2021] [authz_core:debug] [pid 413]
mod_authz_core.c(809): [client 1.2.3.4:52629] AH01626: authorization
result of <RequireAny>: denied (no authenticated user yet), referer:
https://acme.server.org/
There is a "granted" in between, but it does not work. Then
authentication itself seems to work, though, because if I specify the
wrong password, the logs lines change to:
[Sat Sep 25 18:43:43.542566 2021] [authz_core:debug] [pid 432]
mod_authz_core.c(809): [client 1.2.3.4:52678] AH01626: authorization
result of Require valid-user : denied (no authenticated user yet)
[Sat Sep 25 18:43:43.542639 2021] [authz_core:debug] [pid 432]
mod_authz_core.c(809): [client 1.2.3.4:52678] AH01626: authorization
result of <RequireAny>: denied (no authenticated user yet)
[Sat Sep 25 18:43:45.956792 2021] [ldap:debug] [pid 432]
util_ldap.c(379): AH01278: LDAP: Setting referrals to On.
[Sat Sep 25 18:43:46.139978 2021] [auth_basic:error] [pid 432] [client
1.2.3.4:52678] AH01617: user u_test: authentication failure for "/":
Password Mismatch
I tried various examples found online on how to setup Apache BasicAuth
LDAP Integration with FreeIPA but none worked.
What I don't understand in the first place is the "denied (no
authenticated user yet)" repeating and then in the midle a "require
valid-user: granted". What am I doing wrong here or am I missing the
point entirely?
Any help would be appreciated!
best regards,
Thorsten
2 years, 6 months
sss_ssh_authorizedkeys vs user certificates
by Radoslaw Kujawa
Hi list.
I have a CentOS 8.4 machine (fully updated), where
sss_ssh_authorizedkeys is successfully able to pull public keys from IPA
user certificates. Recently I have installed a new Fedora 34 machine and
this functionality is not working - running "sss_ssh_authorizedkeys
username" only reports public keys explicitly added to the account,
omitting keys from X.509 certificates.
Both machines are joined to the same IPA domain.
I've checked sssd configuration, and ssh_use_certificate_keys option
seems to be default, as the man page states. To be extra sure, I have
also manually added it sssd.conf:
[ssh]
ssh_use_certificate_keys = true
CentOS machine has the following package versions:
python3-sss-murmur-2.4.0-9.el8_4.2.x86_64
sssd-proxy-2.4.0-9.el8_4.2.x86_64
libsss_sudo-2.4.0-9.el8_4.2.x86_64
libsss_autofs-2.4.0-9.el8_4.2.x86_64
sssd-nfs-idmap-2.4.0-9.el8_4.2.x86_64
sssd-2.4.0-9.el8_4.2.x86_64
libsss_idmap-2.4.0-9.el8_4.2.x86_64
sssd-ldap-2.4.0-9.el8_4.2.x86_64
sssd-kcm-2.4.0-9.el8_4.2.x86_64
sssd-dbus-2.4.0-9.el8_4.2.x86_64
python3-cssselect-0.9.2-10.el8.noarch
sssd-ipa-2.4.0-9.el8_4.2.x86_64
sssd-ad-2.4.0-9.el8_4.2.x86_64
python3-sssdconfig-2.4.0-9.el8_4.2.noarch
sssd-krb5-2.4.0-9.el8_4.2.x86_64
sssd-tools-2.4.0-9.el8_4.2.x86_64
sssd-client-2.4.0-9.el8_4.2.x86_64
sssd-krb5-common-2.4.0-9.el8_4.2.x86_64
sssd-common-2.4.0-9.el8_4.2.x86_64
sssd-common-pac-2.4.0-9.el8_4.2.x86_64
libsss_certmap-2.4.0-9.el8_4.2.x86_64
libsss_nss_idmap-2.4.0-9.el8_4.2.x86_64
libsss_simpleifp-2.4.0-9.el8_4.2.x86_64
python3-sss-2.4.0-9.el8_4.2.x86_64
Fedora machine has the following package versions:
libsss_idmap-2.5.2-2.fc34.aarch64
libsss_autofs-2.5.2-2.fc34.aarch64
libsss_sudo-2.5.2-2.fc34.aarch64
libsss_certmap-2.5.2-2.fc34.aarch64
sssd-nfs-idmap-2.5.2-2.fc34.aarch64
libsss_nss_idmap-2.5.2-2.fc34.aarch64
sssd-client-2.5.2-2.fc34.aarch64
sssd-common-2.5.2-2.fc34.aarch64
sssd-common-pac-2.5.2-2.fc34.aarch64
sssd-dbus-2.5.2-2.fc34.aarch64
sssd-krb5-common-2.5.2-2.fc34.aarch64
python3-sssdconfig-2.5.2-2.fc34.noarch
python3-sss-2.5.2-2.fc34.aarch64
sssd-tools-2.5.2-2.fc34.aarch64
python3-sss-murmur-2.5.2-2.fc34.aarch64
sssd-ipa-2.5.2-2.fc34.aarch64
sssd-kcm-2.5.2-2.fc34.aarch64
Any hints on how to make sss_ssh_authorizedkeys pull keys from IPA user
certificates on Fedora, or how to further debug this?
Best regards,
Radoslaw
2 years, 6 months
FreeIPA - FreeRADIUS - privacyIDEA: OTP login not possible with policy otppin = userstore
by Guido Nottebrok
Configuration:
FreeIPA and FreeRADIUS : Fedora 34 on host ipa.example.com with ip 192.168.1.139 (Proxmox LXC Container)
privacyIDEA: Debian 10 on host mfa.example.com with ip 192.168.1.136 (Proxmox LXC Container)
yum info freeipa-server
Version : 4.9.6
yum info freeradius
Version : 3.0.21
pip show privacyidea
Name: privacyIDEA
Version: 3.5.1
The connection between FreeRADIUS and privacyIDEA is configured with the perl module privacyidea_radius.pm
# ipa user-show otp_test
Principal name: otp_test(a)EXAMPLE.COM
User authentication types: radius, otp
RADIUS proxy configuration: privacyidea
Password: True
Kerberos keys available: True
# ipa user-show ipa_test
Principal name: ipa_test(a)EXAMPLE.COM
User authentication types: password
Password: True
Kerberos keys available: True
# ipa radiusproxy-show privacyidea
RADIUS proxy server name: privacyidea
Server: 192.168.1.139
Problem:
It is not possible to login with user otp_test when the policy in privacyIDEA is set to 'otppin = userstore'.
Test:
[ipa_test@ipa ~]$ su otp_test
First Factor: <password>
Second Factor: <otp>
su: Authentication failure
If I set the privacyIDEA policy to 'otppin = tokenpin' and set the pin = <password> login works.
So I think that in general authentication with privacyIDEA works.
The problem is that privacyIDEA can not check the password against the FreeIPA LDAP as you can see in the privacyidea.log file.
In the krb5kdc.log you can see 'preauth (otp) verify failure: Generic preauthentication failure'
Can anybody help me to fix that?
Here are parts of the logs:
/var/log/privacyidea/privacyidea.log
------------------------------------
[2021-09-22 05:27:03,157][5358][139872937498368][INFO][privacyidea.lib.crypto:821] initializing HSM class: <class 'privacyidea.lib.security.default.DefaultSecurityModule'>
[2021-09-22 05:27:03,158][5358][139872937498368][INFO][privacyidea.lib.crypto:260] Initialized HSM object {'obj': <privacyidea.lib.security.default.DefaultSecurityModule object at 0x7f36a43b48d0>}
[2021-09-22 05:27:03,486][5358][139872937498368][INFO][privacyidea.lib.user:233] user 'otp_test' found in resolver 'FreeIPA'
[2021-09-22 05:27:03,486][5358][139872937498368][INFO][privacyidea.lib.user:234] userid resolved to '69820e7e-1872-11ec-b5e7-8ae8999d4764'
[2021-09-22 05:27:03,492][5358][139872937498368][INFO][privacyidea.lib.pooling:119] Created a new engine registry: <privacyidea.lib.pooling.NullEngineRegistry object at 0x7f369fa787b8>
[2021-09-22 05:27:03,557][5358][139872937498368][INFO][privacyidea.lib.tokens.vasco:56] PI_VASCO_LIBRARY option is not set, functionality disabled
[2021-09-22 05:27:03,566][5358][139872937498368][INFO][privacyidea.lib.user:360] User 'otp_test' from realm 'example.com' tries to authenticate
[2021-09-22 05:27:03,576][5358][139872937498368][WARNING][privacyidea.lib.resolvers.LDAPIdResolver:354] failed to check password for '69820e7e-1872-11ec-b5e7-8ae8999d4764'/'uid=otp_test,cn=users,cn=accounts,dc=nottebrok,dc=net': Exception('Wrong credentials')
[2021-09-22 05:27:03,577][5358][139872937498368][INFO][privacyidea.lib.user:371] user User(login='otp_test', realm='example.com', resolver='FreeIPA') failed to authenticate.
/var/log/radius/radius.log
--------------------------
Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Config File /etc/privacyidea/rlm_perl.ini found!
Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Debugging config: true
Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Default URL https://mfa.example.com/validate/check
Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Looking for config for auth-type Perl
Wed Sep 22 05:27:01 2021 : rlm_perl: RAD_REQUEST: User-Password = <password><otp>
Wed Sep 22 05:27:01 2021 : rlm_perl: RAD_REQUEST: Packet-Src-IP-Address = 192.168.1.139
Wed Sep 22 05:27:01 2021 : rlm_perl: RAD_REQUEST: NAS-Identifier = ipa.example.com
Wed Sep 22 05:27:01 2021 : rlm_perl: RAD_REQUEST: Service-Type = Authenticate-Only
Wed Sep 22 05:27:01 2021 : rlm_perl: RAD_REQUEST: User-Name = otp_test
Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Password encoding guessed: ascii
Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Setting client IP to 192.168.1.139.
Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Auth-Type: Perl
Wed Sep 22 05:27:01 2021 : Info: rlm_perl: url: https://mfa.example.com/validate/check
Wed Sep 22 05:27:01 2021 : Info: rlm_perl: user sent to privacyidea: otp_test
Wed Sep 22 05:27:01 2021 : Info: rlm_perl: realm sent to privacyidea:
Wed Sep 22 05:27:01 2021 : Info: rlm_perl: resolver sent to privacyidea:
Wed Sep 22 05:27:01 2021 : Info: rlm_perl: client sent to privacyidea: 192.168.1.139
Wed Sep 22 05:27:01 2021 : Info: rlm_perl: state sent to privacyidea:
Wed Sep 22 05:27:01 2021 : rlm_perl: urlparam client = 192.168.1.139
Wed Sep 22 05:27:01 2021 : rlm_perl: urlparam pass = <password><otp>
Wed Sep 22 05:27:01 2021 : rlm_perl: urlparam user = otp_test
Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Request timeout: 10
Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Not verifying SSL certificate!
Wed Sep 22 05:27:03 2021 : Info: rlm_perl: elapsed time for privacyidea call: 2.298527
Wed Sep 22 05:27:03 2021 : rlm_perl: Content {"detail": {"message": "wrong otp pin", "threadid": 139872937498368}, "id": 1, "jsonrpc": "2.0", "result": {"status": true, "value": false}, "time": 1632288423.7560399, "version": "privacyIDEA 3.5.1", "versionnumber": "3.5.1", "signature": "rsa_sha256_pss:a4ea05ca498b36c09137d1f492bc882109adfc8a7fb3a185fb4b8638255dd2539659897591afdffd99b6cdd1bb5c5741f63f2037abdc85c5bafae669a97f1e7cbc76f26da70139651e796e60550d9410c7f7c6cab8f3581cbb6f676683da9a1c4659ec2f30187d18c25297dda2a61e06085ee4265606670377040247e19bb58ca0f04aca71cf30b198376eaf263503228176ec249dccb82036e987d190c6108fddadebd250deb2c19995b7dbeeb8ed2d233066389c871e99c76d85ef908009448c5af2ca7d0605852720bdb9ade99b58711593c9b9f92a2ca45aa351d0d33c721df9417d464aaf9052cdce99440d851ea6f9940de8576df4023974866cc5fb16"}
Wed Sep 22 05:27:03 2021 : Info: rlm_perl: privacyIDEA Result status is true!
Wed Sep 22 05:27:03 2021 : Info: rlm_perl: privacyIDEA access denied for otp_test realm=''
Wed Sep 22 05:27:03 2021 : Info: rlm_perl: return RLM_MODULE_REJECT
/var/log/dirsrv/slapd-NOTTEBROK-NET/access
------------------------------------------
[22/Sep/2021:05:27:01.564080274 +0000] conn=3895 op=2 RESULT err=0 tag=101 nentries=1 wtime=0.000049870 optime=0.000150998 etime=0.000199231
[22/Sep/2021:05:27:01.564323730 +0000] conn=3895 op=3 SRCH base="cn=privacyidea,cn=radiusproxy,dc=nottebrok,dc=net" scope=0 filter="(objectClass=*)" attrs="ipatokenRadiusServer ipatokenRadiusSecret ipatokenRadiusTimeout ipatokenRadiusRetries ipatokenUserMapAttribute"
[22/Sep/2021:05:27:01.564421567 +0000] conn=3895 op=3 RESULT err=0 tag=101 nentries=1 wtime=0.000041954 optime=0.000099034 etime=0.000139513
[22/Sep/2021:05:27:01.566557293 +0000] conn=3892 op=11 SRCH base="cn=ipservices,cn=accounts,dc=nottebrok,dc=net" scope=2 filter="(&(cn=radius)(ipServiceProtocol=udp)(objectClass=ipService))" attrs="objectClass cn ipServicePort ipServiceProtocol entryusn"
[22/Sep/2021:05:27:01.566712813 +0000] conn=3892 op=11 RESULT err=0 tag=101 nentries=0 wtime=0.000084750 optime=0.000157349 etime=0.000240250
[22/Sep/2021:05:27:03.246250221 +0000] conn=3897 fd=121 slot=121 connection from 192.168.1.136 to 192.168.1.139
[22/Sep/2021:05:27:03.246571254 +0000] conn=3897 op=-1 fd=121 closed error - B1
[22/Sep/2021:05:27:03.246630909 +0000] conn=3898 fd=126 slot=126 connection from 192.168.1.136 to 192.168.1.139
[22/Sep/2021:05:27:03.246931986 +0000] conn=3898 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="start_tls_plugin"
[22/Sep/2021:05:27:03.246975107 +0000] conn=3898 op=0 RESULT err=0 tag=120 nentries=0 wtime=0.000135107 optime=0.000048051 etime=0.000181367
[22/Sep/2021:05:27:03.250916223 +0000] conn=3898 TLS1.2 128-bit AES-GCM
[22/Sep/2021:05:27:03.251829337 +0000] conn=3898 op=1 BIND dn="uid=privacyidea-bind,cn=sysaccounts,cn=etc,dc=nottebrok,dc=net" method=128 version=3
[22/Sep/2021:05:27:03.252339317 +0000] conn=3898 op=1 RESULT err=0 tag=97 nentries=0 wtime=0.004225141 optime=0.000524375 etime=0.004747290 dn="uid=privacyidea-bind,cn=sysaccounts,cn=etc,dc=nottebrok,dc=net"
[22/Sep/2021:05:27:03.253292531 +0000] conn=3898 op=2 SRCH base="" scope=0 filter="(objectClass=*)" attrs="subschemaSubentry +"
[22/Sep/2021:05:27:03.254751970 +0000] conn=3898 op=2 RESULT err=0 tag=101 nentries=1 wtime=0.000091257 optime=0.001461035 etime=0.001549672
[22/Sep/2021:05:27:03.256597869 +0000] conn=3898 op=3 SRCH base="cn=schema" scope=0 filter="(objectClass=subschema)" attrs="objectClasses attributeTypes ldapSyntaxes matchingRules matchingRuleUse dITContentRules dITStructureRules nameForms createTimestamp modifyTimestamp * + aci"
[22/Sep/2021:05:27:03.351666572 +0000] conn=3898 op=3 RESULT err=0 tag=101 nentries=1 wtime=0.000120956 optime=0.095069951 etime=0.095184874
[22/Sep/2021:05:27:03.484292759 +0000] conn=3898 op=4 SRCH base="cn=users,cn=accounts,dc=nottebrok,dc=net" scope=2 filter="(&(uid=*)(objectClass=inetOrgPerson)(uid=otp_test))" attrs="telephoneNumber mobile mail sn givenName gecos uid ipaUniqueID"
[22/Sep/2021:05:27:03.485807992 +0000] conn=3898 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000140279 optime=0.001516926 etime=0.001653375 notes=U details="Partially Unindexed Filter"
[22/Sep/2021:05:27:03.564155920 +0000] conn=3898 op=5 SRCH base="cn=users,cn=accounts,dc=nottebrok,dc=net" scope=2 filter="(&(uid=*)(objectClass=inetOrgPerson)(ipaUniqueID=69820e7e-1872-11ec-b5e7-8ae8999d4764))" attrs="telephoneNumber mobile mail sn givenName gecos uid"
[22/Sep/2021:05:27:03.565628714 +0000] conn=3898 op=5 RESULT err=0 tag=101 nentries=1 wtime=0.000138785 optime=0.001475478 etime=0.001609564 notes=U details="Partially Unindexed Filter"
[22/Sep/2021:05:27:03.568418557 +0000] conn=3898 op=6 SRCH base="cn=users,cn=accounts,dc=nottebrok,dc=net" scope=2 filter="(&(uid=*)(objectClass=inetOrgPerson)(ipaUniqueID=69820e7e-1872-11ec-b5e7-8ae8999d4764))" attrs="telephoneNumber mobile mail sn givenName gecos uid"
[22/Sep/2021:05:27:03.569936263 +0000] conn=3898 op=6 RESULT err=0 tag=101 nentries=1 wtime=0.000139985 optime=0.001520723 etime=0.001656185 notes=U details="Partially Unindexed Filter"
[22/Sep/2021:05:27:03.570551770 +0000] conn=3899 fd=121 slot=121 connection from 192.168.1.136 to 192.168.1.139
[22/Sep/2021:05:27:03.570832412 +0000] conn=3899 op=-1 fd=121 closed error - B1
[22/Sep/2021:05:27:03.570894957 +0000] conn=3900 fd=127 slot=127 connection from 192.168.1.136 to 192.168.1.139
[22/Sep/2021:05:27:03.571225293 +0000] conn=3900 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="start_tls_plugin"
[22/Sep/2021:05:27:03.571270580 +0000] conn=3900 op=0 RESULT err=0 tag=120 nentries=0 wtime=0.000153969 optime=0.000047853 etime=0.000200296
[22/Sep/2021:05:27:03.574890946 +0000] conn=3900 TLS1.2 128-bit AES-GCM
[22/Sep/2021:05:27:03.575569529 +0000] conn=3900 op=1 BIND dn="uid=otp_test,cn=users,cn=accounts,dc=nottebrok,dc=net" method=128 version=3
[22/Sep/2021:05:27:03.576077489 +0000] conn=3900 op=1 RESULT err=49 tag=97 nentries=0 wtime=0.003805205 optime=0.000518648 etime=0.004320920
[22/Sep/2021:05:27:04.869258275 +0000] conn=3029 op=13493 MOD dn="uid=otp_test,cn=users,cn=accounts,dc=nottebrok,dc=net"
[22/Sep/2021:05:27:04.939090470 +0000] conn=3029 op=13493 RESULT err=0 tag=103 nentries=0 wtime=0.000077276 optime=0.069837500 etime=0.069910794
[22/Sep/2021:05:27:04.940438540 +0000] conn=3890 op=36 SRCH base="cn=etc,dc=nottebrok,dc=net" scope=2 filter="(&(cn=ipaConfig)(objectClass=ipaGuiConfig))" attrs="ipaMigrationEnabled ipaSELinuxUserMapDefault ipaSELinuxUserMapOrder"
[22/Sep/2021:05:27:04.940991039 +0000] conn=3890 op=36 RESULT err=0 tag=101 nentries=1 wtime=0.000166940 optime=0.000555022 etime=0.000718249
/var/log/krb5kdc.log
--------------------
Sep 22 05:27:01 ipa krb5kdc[8615](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 192.168.1.129: NEEDED_PREAUTH: otp_test(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Additional pre-authentication required
Sep 22 05:27:01 ipa krb5kdc[8615](info): closing down fd 11
Sep 22 05:27:01 ipa krb5kdc[8615](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 192.168.1.129: NEEDED_PREAUTH: otp_test(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Additional pre-authentication required
Sep 22 05:27:01 ipa krb5kdc[8615](info): closing down fd 11
Sep 22 05:27:04 ipa krb5kdc[8615](info): preauth (otp) verify failure: Generic preauthentication failure
Sep 22 05:27:04 ipa krb5kdc[8615](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 192.168.1.129: PREAUTH_FAILED: otp_test(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Preauthentication failed
Sep 22 05:27:04 ipa krb5kdc[8615](info): closing down fd 11
2 years, 6 months
fedora coreos :: ipa-client-install makes system users disappear
by hillar aarelaid
Fedora CoreOS 34.20210904.3.0
```
[root@fcostest ~]# id -u systemd-resolve
990
[root@fcostest ~]# ipa-client-install --unattended -p ${IPA_USER} -w ${IPA_PASS} --domain ${IPA_DOMAIN} --ntp-pool ${NTP_POOL} --force --force-join
This program will set up IPA client.
Version 4.9.6
...
The ipa-client-install command was successful
[root@fcostest ~]# id -u systemd-resolve
id: ‘systemd-resolve’: no such user
```
Any suggestion for fix || workaround ?
2 years, 6 months
IPA/dirsrv hang
by Kathy Zhu
Hi list,
one of my ipa server (dirsrv) hang this morning. "ipactl status" no output
and did not return. With nsslapd-errorlog-level being set to 16384,
however, very few log entries. I rebooted the server to recover. But after
reboot, ipa hang again then I have to reboot it. I collected following
before 2nd reboot:
Check where the process got stuck:
[root@ipa5 ~]# cat /proc/$PID/stack
[<ffffffffb0a63465>] poll_schedule_timeout+0x55/0xc0
[<ffffffffb0a64bfd>] do_sys_poll+0x48d/0x590
[<ffffffffb0a64e04>] SyS_poll+0x74/0x110
[<ffffffffb0f92ed2>] system_call_fastpath+0x25/0x2a
[<ffffffffffffffff>] 0xffffffffffffffff
[root@ipa5 ~]#
check if there is any lock in place:
[root@ipa5 ~]# gdb -ex 'set confirm off' -ex 'set pagination off' -ex
'thread apply all bt full' -ex 'quit' /usr/sbin/ns-slapd $PID |& grep
'^#0.*lock'
#0 0x00007f132465f39e in pthread_rwlock_wrlock () at /lib64/libpthread.so.0
#0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0
#0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0
#0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0
#0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0
#0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0
#0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0
#0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0
#0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0
#0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0
#0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0
#0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0
#0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0
#0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0
#0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0
#0 0x00007f132465f39e in pthread_rwlock_wrlock () at /lib64/libpthread.so.0
[root@ipa5 ~]#
The software versions:
Centos 7-8.2003.0 SELinux enabled
389-ds-base-1.3.10.2-12.el7_9.x86_64
389-ds-base-libs-1.3.10.2-12.el7_9.x86_64
slapi-nis-0.56.5-3.el7_9.x86_64
I attached related messages and dirsrv errors log. Does anyone know how to
fix it?
Many thanks!
Kathy.
In the messages (11:37 was 1st reboot and 14:32 was second reboot):
[root@ipa5 log]# grep ERR messages
Sep 20 09:06:17 ipa5 ns-slapd: [20/Sep/2021:09:06:17.767149314 -0700] - ERR
- NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToipa6.example.com"
(ipa6:389) - Replication bind with GSSAPI auth failed: LDAP error -1 (Can't
contact LDAP server) ()
Sep 21 11:37:24 ipa5 ns-slapd: [21/Sep/2021:11:37:24.603324539 -0700] - ERR
- schema-compat-plugin - scheduled schema-compat-plugin tree scan in about
5 seconds after the server startup!
Sep 21 11:37:25 ipa5 ns-slapd: [21/Sep/2021:11:37:25.630440119 -0700] - ERR
- set_krb5_creds - Could not get initial credentials for principal [ldap/
ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]:
-1765328228 (Cannot contact any KDC for requested realm)
Sep 21 11:37:25 ipa5 ns-slapd: [21/Sep/2021:11:37:25.676602753 -0700] - ERR
- schema-compat-plugin - schema-compat-plugin tree scan will start in about
5 seconds!
Sep 21 11:37:25 ipa5 ns-slapd: [21/Sep/2021:11:37:25.714060760 -0700] - ERR
- set_krb5_creds - Could not get initial credentials for principal [ldap/
ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]:
-1765328228 (Cannot contact any KDC for requested realm)
Sep 21 11:37:25 ipa5 ns-slapd: [21/Sep/2021:11:37:25.796587660 -0700] - ERR
- set_krb5_creds - Could not get initial credentials for principal [ldap/
ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]:
-1765328228 (Cannot contact any KDC for requested realm)
Sep 21 11:37:25 ipa5 ns-slapd: [21/Sep/2021:11:37:25.879136209 -0700] - ERR
- set_krb5_creds - Could not get initial credentials for principal [ldap/
ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]:
-1765328228 (Cannot contact any KDC for requested realm)
Sep 21 11:37:31 ipa5 ns-slapd: [21/Sep/2021:11:37:31.829134731 -0700] - ERR
- schema-compat-plugin - warning: no entries set up under cn=computers,
cn=compat,dc=example,dc=com
Sep 21 11:37:31 ipa5 ns-slapd: [21/Sep/2021:11:37:31.833560101 -0700] - ERR
- schema-compat-plugin - Finished plugin initialization.
Sep 21 14:32:13 ipa5 ns-slapd: [21/Sep/2021:14:32:13.105730037 -0700] - ERR
- schema-compat-plugin - scheduled schema-compat-plugin tree scan in about
5 seconds after the server startup!
Sep 21 14:32:14 ipa5 ns-slapd: [21/Sep/2021:14:32:14.107014580 -0700] - ERR
- set_krb5_creds - Could not get initial credentials for principal [ldap/
ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]:
-1765328228 (Cannot contact any KDC for requested realm)
Sep 21 14:32:14 ipa5 ns-slapd: [21/Sep/2021:14:32:14.153908801 -0700] - ERR
- schema-compat-plugin - schema-compat-plugin tree scan will start in about
5 seconds!
Sep 21 14:32:14 ipa5 ns-slapd: [21/Sep/2021:14:32:14.191647629 -0700] - ERR
- set_krb5_creds - Could not get initial credentials for principal [ldap/
ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]:
-1765328228 (Cannot contact any KDC for requested realm)
Sep 21 14:32:14 ipa5 ns-slapd: [21/Sep/2021:14:32:14.273919809 -0700] - ERR
- set_krb5_creds - Could not get initial credentials for principal [ldap/
ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]:
-1765328228 (Cannot contact any KDC for requested realm)
Sep 21 14:32:20 ipa5 ns-slapd: [21/Sep/2021:14:32:20.293525463 -0700] - ERR
- schema-compat-plugin - warning: no entries set up under cn=computers,
cn=compat,dc=example,dc=com
Sep 21 14:32:20 ipa5 ns-slapd: [21/Sep/2021:14:32:20.293736655 -0700] - ERR
- schema-compat-plugin - Finished plugin initialization.
[root@ipa5 log]#
errors log (11:37 was 1st reboot and 14:32 was second reboot):
[root@ipa5 slapd-EXAMPLE-COM]# cat errors
389-Directory/1.3.10.2 B2021.160.169
ipa5.example.com:636 (/etc/dirsrv/slapd-EXAMPLE-COM)
[20/Sep/2021:09:06:17.768066990 -0700] - ERR - NSMMReplicationPlugin -
bind_and_check_pwp - agmt="cn=meToipa6.example.com" (ipa6:389) -
Replication bind with GSSAPI auth failed: LDAP error -1 (Can't contact LDAP
server) ()
[20/Sep/2021:09:06:20.348325236 -0700] - INFO - NSMMReplicationPlugin -
bind_and_check_pwp - agmt="cn=meToipa6.example.com" (ipa6:389): Replication
bind with GSSAPI auth resumed
[20/Sep/2021:09:08:24.400342570 -0700] - WARN - NSMMReplicationPlugin -
replica_generate_next_csn - opcsn=6148fb190008002a0000 <=
basecsn=6148fb19ae5800040000, adjusted opcsn=6148fb19ae5a002a0000
[20/Sep/2021:09:09:14.372623984 -0700] - WARN - NSMMReplicationPlugin -
replica_generate_next_csn - opcsn=6148fb4b0007002a0000 <=
basecsn=6148fb4bafac00040000, adjusted opcsn=6148fb4bafae002a0000
[20/Sep/2021:11:51:58.900633352 -0700] - WARN - NSMMReplicationPlugin -
replica_generate_next_csn - opcsn=6149216f0004002a0000 <=
basecsn=6149216f718a00040000, adjusted opcsn=6149216f718c002a0000
[21/Sep/2021:11:26:59.139128524 -0700] - INFO - op_thread_cleanup - slapd
shutting down - signaling operation threads - op stack size 0 max work q
size 316 max work q stack size 12
[21/Sep/2021:11:26:59.140129110 -0700] - INFO - slapd_daemon - slapd
shutting down - waiting for 24 threads to terminate
[21/Sep/2021:11:30:08.927140039 -0700] - WARN - NSMMReplicationPlugin -
acquire_replica - agmt="cn=meToipa6.example.com" (ipa6:389): Unable to
receive the response for a startReplication extended operation to consumer
(Timed out). Will retry later.
[21/Sep/2021:11:37:22.087091069 -0700] - INFO - slapd_extract_cert - CA
CERT NAME: EXAMPLE.COM IPA CA
[21/Sep/2021:11:37:22.107553462 -0700] - WARN - Security Initialization -
SSL alert: Sending pin request to SVRCore. You may need to run
systemd-tty-ask-password-agent to provide the password.
[21/Sep/2021:11:37:22.108208619 -0700] - INFO - slapd_extract_cert - SERVER
CERT NAME: Server-Cert
[21/Sep/2021:11:37:22.121340459 -0700] - INFO - Security Initialization -
SSL info: Enabling default cipher set.
[21/Sep/2021:11:37:22.131009941 -0700] - INFO - Security Initialization -
SSL info: Configured NSS Ciphers
[21/Sep/2021:11:37:22.141010955 -0700] - INFO - Security Initialization -
SSL info: TLS_AES_128_GCM_SHA256: enabled
[21/Sep/2021:11:37:22.143647711 -0700] - INFO - Security Initialization -
SSL info: TLS_CHACHA20_POLY1305_SHA256: enabled
[21/Sep/2021:11:37:22.143881989 -0700] - INFO - Security Initialization -
SSL info: TLS_AES_256_GCM_SHA384: enabled
[21/Sep/2021:11:37:22.144109322 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: enabled
[21/Sep/2021:11:37:22.144325392 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: enabled
[21/Sep/2021:11:37:22.144620475 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled
[21/Sep/2021:11:37:22.144823798 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: enabled
[21/Sep/2021:11:37:22.145040176 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: enabled
[21/Sep/2021:11:37:22.145248453 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: enabled
[21/Sep/2021:11:37:22.145449371 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: enabled
[21/Sep/2021:11:37:22.145647646 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled
[21/Sep/2021:11:37:22.145844189 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled
[21/Sep/2021:11:37:22.146054551 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: enabled
[21/Sep/2021:11:37:22.146251412 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: enabled
[21/Sep/2021:11:37:22.146449693 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA: enabled
[21/Sep/2021:11:37:22.146735864 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_DSS_WITH_AES_256_CBC_SHA: enabled
[21/Sep/2021:11:37:22.146936445 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: enabled
[21/Sep/2021:11:37:22.147149142 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: enabled
[21/Sep/2021:11:37:22.147348187 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled
[21/Sep/2021:11:37:22.147543861 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA: enabled
[21/Sep/2021:11:37:22.147740471 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_DSS_WITH_AES_128_CBC_SHA: enabled
[21/Sep/2021:11:37:22.147945320 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: enabled
[21/Sep/2021:11:37:22.148203907 -0700] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_256_GCM_SHA384: enabled
[21/Sep/2021:11:37:22.148408650 -0700] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_256_CBC_SHA: enabled
[21/Sep/2021:11:37:22.148608462 -0700] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled
[21/Sep/2021:11:37:22.148856140 -0700] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_128_GCM_SHA256: enabled
[21/Sep/2021:11:37:22.149070747 -0700] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_128_CBC_SHA: enabled
[21/Sep/2021:11:37:22.149270007 -0700] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_128_CBC_SHA256: enabled
[21/Sep/2021:11:37:22.152892336 -0700] - INFO - Security Initialization -
slapd_ssl_init2 - Configured SSL version range: min: TLS1.0, max: TLS1.2
[21/Sep/2021:11:37:22.153485284 -0700] - INFO - main - 389-Directory/
1.3.10.2 B2021.160.169 starting up
[21/Sep/2021:11:37:22.153702300 -0700] - INFO - main - Setting the maximum
file descriptor limit to: 16384
[21/Sep/2021:11:37:24.381088447 -0700] - INFO -
ldbm_instance_config_cachememsize_set - force a minimal value 512000
[21/Sep/2021:11:37:24.383729177 -0700] - WARN - default_mr_indexer_create -
Plugin [caseIgnoreIA5Match] does not handle caseExactIA5Match
[21/Sep/2021:11:37:24.385755952 -0700] - INFO -
ldbm_instance_config_cachememsize_set - force a minimal value 512000
[21/Sep/2021:11:37:24.389648132 -0700] - INFO -
ldbm_instance_config_cachememsize_set - force a minimal value 512000
[21/Sep/2021:11:37:24.393387733 -0700] - NOTICE - ldbm_back_start - found
8008992k physical memory
[21/Sep/2021:11:37:24.393534680 -0700] - NOTICE - ldbm_back_start - found
7254208k available
[21/Sep/2021:11:37:24.393666179 -0700] - NOTICE - ldbm_back_start - cache
autosizing: db cache: 200224k
[21/Sep/2021:11:37:24.393811926 -0700] - NOTICE - ldbm_back_start - cache
autosizing: userRoot entry cache (3 total): 196608k
[21/Sep/2021:11:37:24.394413949 -0700] - NOTICE - ldbm_back_start - cache
autosizing: userRoot dn cache (3 total): 65536k
[21/Sep/2021:11:37:24.395241483 -0700] - NOTICE - ldbm_back_start - cache
autosizing: ipaca entry cache (3 total): 196608k
[21/Sep/2021:11:37:24.395762334 -0700] - NOTICE - ldbm_back_start - cache
autosizing: ipaca dn cache (3 total): 65536k
[21/Sep/2021:11:37:24.396437365 -0700] - NOTICE - ldbm_back_start - cache
autosizing: changelog entry cache (3 total): 196608k
[21/Sep/2021:11:37:24.396931574 -0700] - NOTICE - ldbm_back_start - cache
autosizing: changelog dn cache (3 total): 65536k
[21/Sep/2021:11:37:24.399397009 -0700] - NOTICE - ldbm_back_start - total
cache size: 969330524 B;
[21/Sep/2021:11:37:24.402519856 -0700] - NOTICE - dblayer_start - Detected
Disorderly Shutdown last time Directory Server was running, recovering
database.
[21/Sep/2021:11:37:24.603333323 -0700] - ERR - schema-compat-plugin -
scheduled schema-compat-plugin tree scan in about 5 seconds after the
server startup!
[21/Sep/2021:11:37:24.619972344 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=groups,cn=compat,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.620216729 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=computers,cn=compat,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.620395665 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=ng,cn=compat,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.620631777 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target ou=sudoers,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.620809457 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=users,cn=compat,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.621006476 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.621182026 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.621361114 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.621543112 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.621719758 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.621912694 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.622087172 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.622263736 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.622439497 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.622616843 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.622793368 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.663383897 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=casigningcert
cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.663575439 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=casigningcert
cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com does not exist
[21/Sep/2021:11:37:24.727752819 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not
exist
[21/Sep/2021:11:37:24.754864655 -0700] - NOTICE - NSMMReplicationPlugin -
changelog program - _cl5ConstructRUV - Rebuilding the replication changelog
RUV, this may take several minutes...
[21/Sep/2021:11:37:24.757027555 -0700] - NOTICE - NSMMReplicationPlugin -
changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV
complete. Result 0 (Success)
[21/Sep/2021:11:37:24.757181126 -0700] - NOTICE - NSMMReplicationPlugin -
changelog program - _cl5ConstructRUV - Rebuilding the replication changelog
RUV, this may take several minutes...
[21/Sep/2021:11:37:24.759270661 -0700] - NOTICE - NSMMReplicationPlugin -
changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV
complete. Result 0 (Success)
[21/Sep/2021:11:37:24.959483078 -0700] - NOTICE - NSMMReplicationPlugin -
changelog program - _cl5ConstructRUV - Rebuilding the replication changelog
RUV, this may take several minutes...
[21/Sep/2021:11:37:25.287387667 -0700] - NOTICE - NSMMReplicationPlugin -
changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV
complete. Result 0 (Success)
[21/Sep/2021:11:37:25.287687713 -0700] - NOTICE - NSMMReplicationPlugin -
changelog program - _cl5ConstructRUV - Rebuilding the replication changelog
RUV, this may take several minutes...
[21/Sep/2021:11:37:25.626948414 -0700] - NOTICE - NSMMReplicationPlugin -
changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV
complete. Result 0 (Success)
[21/Sep/2021:11:37:25.628156874 -0700] - WARN - NSMMReplicationPlugin -
replica_check_for_data_reload - Disorderly shutdown for replica o=ipaca.
Check if DB RUV needs to be updated
[21/Sep/2021:11:37:25.628441700 -0700] - WARN - NSMMReplicationPlugin -
replica_check_for_data_reload - Disorderly shutdown for replica
dc=example,dc=com. Check if DB RUV needs to be updated
[21/Sep/2021:11:37:25.628593983 -0700] - NOTICE - NSMMReplicationPlugin -
Force update of database RUV (from CL RUV) -> 614a6468b12c002a0000
[21/Sep/2021:11:37:25.628741783 -0700] - NOTICE - NSMMReplicationPlugin -
Force update of database RUV (from CL RUV) -> 614a6465b119001c0000
[21/Sep/2021:11:37:25.630449068 -0700] - ERR - set_krb5_creds - Could not
get initial credentials for principal [ldap/ipa5.example.com(a)EXAMPLE.COM]
in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC
for requested realm)
[21/Sep/2021:11:37:25.637993198 -0700] - INFO - slapd_daemon - slapd
started. Listening on All Interfaces port 389 for LDAP requests
[21/Sep/2021:11:37:25.638150651 -0700] - INFO - slapd_daemon - Listening on
All Interfaces port 636 for LDAPS requests
[21/Sep/2021:11:37:25.638294957 -0700] - INFO - slapd_daemon - Listening on
/var/run/slapd-EXAMPLE-COM.socket for LDAPI requests
[21/Sep/2021:11:37:25.676737896 -0700] - ERR - schema-compat-plugin -
schema-compat-plugin tree scan will start in about 5 seconds!
[21/Sep/2021:11:37:25.714069163 -0700] - ERR - set_krb5_creds - Could not
get initial credentials for principal [ldap/ipa5.example.com(a)EXAMPLE.COM]
in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC
for requested realm)
[21/Sep/2021:11:37:25.796599172 -0700] - ERR - set_krb5_creds - Could not
get initial credentials for principal [ldap/ipa5.example.com(a)EXAMPLE.COM]
in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC
for requested realm)
[21/Sep/2021:11:37:25.879148077 -0700] - ERR - set_krb5_creds - Could not
get initial credentials for principal [ldap/ipa5.example.com(a)EXAMPLE.COM]
in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC
for requested realm)
[21/Sep/2021:11:37:29.469422032 -0700] - INFO - csngen_new_csn - Detected
large jump in CSN time. Delta: 3195237 (current time: 1632249449 vs previous
time: 1629054212)
[21/Sep/2021:11:37:31.829146877 -0700] - ERR - schema-compat-plugin -
warning: no entries set up under cn=computers, cn=compat,dc=example,dc=com
[21/Sep/2021:11:37:31.833570449 -0700] - ERR - schema-compat-plugin -
Finished plugin initialization.
[21/Sep/2021:14:21:48.128729268 -0700] - INFO - op_thread_cleanup - slapd
shutting down - signaling operation threads - op stack size 0 max work q
size 1237 max work q stack size 5
[21/Sep/2021:14:21:48.130690397 -0700] - INFO - slapd_daemon - slapd
shutting down - waiting for 24 threads to terminate
[21/Sep/2021:14:32:10.605597874 -0700] - INFO - slapd_extract_cert - CA
CERT NAME: EXAMPLE.COM IPA CA
[21/Sep/2021:14:32:10.606686976 -0700] - WARN - Security Initialization -
SSL alert: Sending pin request to SVRCore. You may need to run
systemd-tty-ask-password-agent to provide the password.
[21/Sep/2021:14:32:10.607191737 -0700] - INFO - slapd_extract_cert - SERVER
CERT NAME: Server-Cert
[21/Sep/2021:14:32:10.610492924 -0700] - INFO - Security Initialization -
SSL info: Enabling default cipher set.
[21/Sep/2021:14:32:10.610702247 -0700] - INFO - Security Initialization -
SSL info: Configured NSS Ciphers
[21/Sep/2021:14:32:10.610883434 -0700] - INFO - Security Initialization -
SSL info: TLS_AES_128_GCM_SHA256: enabled
[21/Sep/2021:14:32:10.611082442 -0700] - INFO - Security Initialization -
SSL info: TLS_CHACHA20_POLY1305_SHA256: enabled
[21/Sep/2021:14:32:10.611262035 -0700] - INFO - Security Initialization -
SSL info: TLS_AES_256_GCM_SHA384: enabled
[21/Sep/2021:14:32:10.611464581 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: enabled
[21/Sep/2021:14:32:10.611640568 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: enabled
[21/Sep/2021:14:32:10.611817444 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled
[21/Sep/2021:14:32:10.612010226 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: enabled
[21/Sep/2021:14:32:10.612186942 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: enabled
[21/Sep/2021:14:32:10.612359300 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: enabled
[21/Sep/2021:14:32:10.612534043 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: enabled
[21/Sep/2021:14:32:10.612707265 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled
[21/Sep/2021:14:32:10.612890259 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled
[21/Sep/2021:14:32:10.613072932 -0700] - INFO - Security Initialization -
SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: enabled
[21/Sep/2021:14:32:10.613252512 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: enabled
[21/Sep/2021:14:32:10.613428106 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA: enabled
[21/Sep/2021:14:32:10.613607982 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_DSS_WITH_AES_256_CBC_SHA: enabled
[21/Sep/2021:14:32:10.613783773 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: enabled
[21/Sep/2021:14:32:10.613963528 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: enabled
[21/Sep/2021:14:32:10.614139566 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled
[21/Sep/2021:14:32:10.614313931 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA: enabled
[21/Sep/2021:14:32:10.614485765 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_DSS_WITH_AES_128_CBC_SHA: enabled
[21/Sep/2021:14:32:10.614667815 -0700] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: enabled
[21/Sep/2021:14:32:10.614843058 -0700] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_256_GCM_SHA384: enabled
[21/Sep/2021:14:32:10.615033164 -0700] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_256_CBC_SHA: enabled
[21/Sep/2021:14:32:10.615208640 -0700] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled
[21/Sep/2021:14:32:10.615384704 -0700] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_128_GCM_SHA256: enabled
[21/Sep/2021:14:32:10.615558123 -0700] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_128_CBC_SHA: enabled
[21/Sep/2021:14:32:10.615747508 -0700] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_128_CBC_SHA256: enabled
[21/Sep/2021:14:32:10.619176886 -0700] - INFO - Security Initialization -
slapd_ssl_init2 - Configured SSL version range: min: TLS1.0, max: TLS1.2
[21/Sep/2021:14:32:10.619596992 -0700] - INFO - main - 389-Directory/
1.3.10.2 B2021.160.169 starting up
[21/Sep/2021:14:32:10.619786789 -0700] - INFO - main - Setting the maximum
file descriptor limit to: 16384
[21/Sep/2021:14:32:12.863761900 -0700] - INFO -
ldbm_instance_config_cachememsize_set - force a minimal value 512000
[21/Sep/2021:14:32:12.866303167 -0700] - WARN - default_mr_indexer_create -
Plugin [caseIgnoreIA5Match] does not handle caseExactIA5Match
[21/Sep/2021:14:32:12.868327459 -0700] - INFO -
ldbm_instance_config_cachememsize_set - force a minimal value 512000
[21/Sep/2021:14:32:12.872018894 -0700] - INFO -
ldbm_instance_config_cachememsize_set - force a minimal value 512000
[21/Sep/2021:14:32:12.875942159 -0700] - NOTICE - ldbm_back_start - found
8008992k physical memory
[21/Sep/2021:14:32:12.876118261 -0700] - NOTICE - ldbm_back_start - found
7273264k available
[21/Sep/2021:14:32:12.876251543 -0700] - NOTICE - ldbm_back_start - cache
autosizing: db cache: 200224k
[21/Sep/2021:14:32:12.876401888 -0700] - NOTICE - ldbm_back_start - cache
autosizing: userRoot entry cache (3 total): 196608k
[21/Sep/2021:14:32:12.877015107 -0700] - NOTICE - ldbm_back_start - cache
autosizing: userRoot dn cache (3 total): 65536k
[21/Sep/2021:14:32:12.879111165 -0700] - NOTICE - ldbm_back_start - cache
autosizing: ipaca entry cache (3 total): 196608k
[21/Sep/2021:14:32:12.879699133 -0700] - NOTICE - ldbm_back_start - cache
autosizing: ipaca dn cache (3 total): 65536k
[21/Sep/2021:14:32:12.880810497 -0700] - NOTICE - ldbm_back_start - cache
autosizing: changelog entry cache (3 total): 196608k
[21/Sep/2021:14:32:12.881400177 -0700] - NOTICE - ldbm_back_start - cache
autosizing: changelog dn cache (3 total): 65536k
[21/Sep/2021:14:32:12.883113645 -0700] - NOTICE - ldbm_back_start - total
cache size: 969330524 B;
[21/Sep/2021:14:32:12.886703828 -0700] - NOTICE - dblayer_start - Detected
Disorderly Shutdown last time Directory Server was running, recovering
database.
[21/Sep/2021:14:32:13.105739416 -0700] - ERR - schema-compat-plugin -
scheduled schema-compat-plugin tree scan in about 5 seconds after the
server startup!
[21/Sep/2021:14:32:13.122672646 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=groups,cn=compat,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.122865415 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=computers,cn=compat,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.123066536 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=ng,cn=compat,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.123271167 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target ou=sudoers,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.123441717 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=users,cn=compat,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.123629053 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.123800535 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.123971584 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.124143620 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.124311857 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.124489965 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.124665189 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.124836908 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.125004506 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.125172452 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.125341330 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.167392303 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=casigningcert
cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.167585840 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=casigningcert
cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com does not exist
[21/Sep/2021:14:32:13.231724926 -0700] - WARN - NSACLPlugin - acl_parse -
The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not
exist
[21/Sep/2021:14:32:13.256786460 -0700] - NOTICE - NSMMReplicationPlugin -
changelog program - _cl5ConstructRUV - Rebuilding the replication changelog
RUV, this may take several minutes...
[21/Sep/2021:14:32:13.258790153 -0700] - NOTICE - NSMMReplicationPlugin -
changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV
complete. Result 0 (Success)
[21/Sep/2021:14:32:13.258932037 -0700] - NOTICE - NSMMReplicationPlugin -
changelog program - _cl5ConstructRUV - Rebuilding the replication changelog
RUV, this may take several minutes...
[21/Sep/2021:14:32:13.260869035 -0700] - NOTICE - NSMMReplicationPlugin -
changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV
complete. Result 0 (Success)
[21/Sep/2021:14:32:13.453340945 -0700] - NOTICE - NSMMReplicationPlugin -
changelog program - _cl5ConstructRUV - Rebuilding the replication changelog
RUV, this may take several minutes...
[21/Sep/2021:14:32:13.778192948 -0700] - NOTICE - NSMMReplicationPlugin -
changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV
complete. Result 0 (Success)
[21/Sep/2021:14:32:13.778399400 -0700] - NOTICE - NSMMReplicationPlugin -
changelog program - _cl5ConstructRUV - Rebuilding the replication changelog
RUV, this may take several minutes...
[21/Sep/2021:14:32:14.104152139 -0700] - NOTICE - NSMMReplicationPlugin -
changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV
complete. Result 0 (Success)
[21/Sep/2021:14:32:14.105222428 -0700] - WARN - NSMMReplicationPlugin -
replica_check_for_data_reload - Disorderly shutdown for replica o=ipaca.
Check if DB RUV needs to be updated
[21/Sep/2021:14:32:14.105487767 -0700] - WARN - NSMMReplicationPlugin -
replica_check_for_data_reload - Disorderly shutdown for replica
dc=example,dc=com. Check if DB RUV needs to be updated
[21/Sep/2021:14:32:14.105629420 -0700] - NOTICE - NSMMReplicationPlugin -
Force update of database RUV (from CL RUV) -> 614a70200002002a0000
[21/Sep/2021:14:32:14.105754006 -0700] - NOTICE - NSMMReplicationPlugin -
Force update of database RUV (from CL RUV) -> 614a701f001100040000
[21/Sep/2021:14:32:14.107024420 -0700] - ERR - set_krb5_creds - Could not
get initial credentials for principal [ldap/ipa5.example.com(a)EXAMPLE.COM]
in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC
for requested realm)
[21/Sep/2021:14:32:14.115281150 -0700] - INFO - slapd_daemon - slapd
started. Listening on All Interfaces port 389 for LDAP requests
[21/Sep/2021:14:32:14.115431268 -0700] - INFO - slapd_daemon - Listening on
All Interfaces port 636 for LDAPS requests
[21/Sep/2021:14:32:14.115563063 -0700] - INFO - slapd_daemon - Listening on
/var/run/slapd-EXAMPLE-COM.socket for LDAPI requests
[21/Sep/2021:14:32:14.153916575 -0700] - ERR - schema-compat-plugin -
schema-compat-plugin tree scan will start in about 5 seconds!
[21/Sep/2021:14:32:14.191656955 -0700] - ERR - set_krb5_creds - Could not
get initial credentials for principal [ldap/ipa5.example.com(a)EXAMPLE.COM]
in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC
for requested realm)
[21/Sep/2021:14:32:14.273925417 -0700] - ERR - set_krb5_creds - Could not
get initial credentials for principal [ldap/ipa5.example.com(a)EXAMPLE.COM]
in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC
for requested realm)
[21/Sep/2021:14:32:17.628480282 -0700] - INFO - csngen_new_csn - Detected
large jump in CSN time. Delta: 3205725 (current time: 1632259937 vs previous
time: 1629054212)
[21/Sep/2021:14:32:20.293538970 -0700] - ERR - schema-compat-plugin -
warning: no entries set up under cn=computers, cn=compat,dc=example,dc=com
[21/Sep/2021:14:32:20.293740865 -0700] - ERR - schema-compat-plugin -
Finished plugin initialization.
[root@ipa5 slapd-EXAMPLE-COM]#
2 years, 6 months
on a client logs increase size very quickly
by lejeczek
Hi guys.
I've noticed I think a patter, such that when IPA clientA
does lots of ssh to a former IPA clientB (or might be to any
non-IPA host?) then logs size go up rapidly.
Logs: sssd_ssh.log, sssd_private.lot.log,
In terms of IPA client configs - those are vanilla default,
nothing added for extra verbosity.
As soon as I add such a non-IPA host as a client then logs
stop growing.
Before I start going through logs I thought I'd ask if this
might be a result of some obvious & gruesome IPA
misconfiguration?
many thanks, L.
2 years, 6 months
New IPA server and unable to sudo from client
by Jeremy Tourville
After all the trouble with fixing a botched upgrade I decided it was easier to build a new IPA Server. Now that I have it up and running I am running into an issue with my ipa enrolled clients. I am unable to sudo. The client says:
<user>@<host> is not allowed to run sudo on <host>. This incident will be reported.
The HBAC test in the GUI tells me "ACCESS GRANTED" so my policy is setup correctly.
I looked at /etc/nsswitch on the client and see a line:
sudoers: files sss
Shouldn't sss be listed first? Stopping, clearing sssd cache and restarting again doesn't fix it, I presume because the order is wrong.
This is happening on two of my ipa clients so far and I hate to go any further until I figure put what the issue is. Is there something on the server side that controls the nsswitch config or do I need to change the config on the client?
2 years, 6 months
sudo rules for local accounts
by iulian roman
Hello everybody,
Does anybody know if it is possible to have sudo rules in FreeIPA for local accounts (accounts which are in /etc/passwd) ?
2 years, 6 months
Signature verification
by Patrick Northon
Hi, I'm having a problem verifying the signature of the latest release
(4.9.7), did something change with how it is signed?
Previous releases work fine:
gpg: Signature made mar 29 jun 2021 11:32:36 EDT
gpg: using RSA key 840A1D1C7F3EC4B2FE5304354719E2B8ABBF621A
gpg: Good signature from "FreeIPA Master Signing Key" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 0E63 D716 D76A C080 A4A3 3513 F408 00B6 298E B963
Subkey fingerprint: 840A 1D1C 7F3E C4B2 FE53 0435 4719 E2B8 ABBF 621A
Current release:
gpg: Signature made jeu 19 aoû 2021 11:23:09 EDT
gpg: using RSA key FAF42668FC4263CD83C365149F853DF24BC2DFE1
gpg: Can't check signature: No public key
Was it signed with a different key?
2 years, 6 months