DNS forward zone - ? - does not forward
by lejeczek
Hi guys
I have a basic fwd zone:
-> $ ipa dnsforwardzone-show private.lot. --all --rights
dn: idnsname=private.lot.,cn=dns,dc=mine,dc=private
Zone name: private.lot.
Active zone: TRUE
Zone forwarders: 10.3.1.221, 10.3.1.222
Forward policy: only
attributelevelrights: {'objectclass': 'rscwo', 'aci':
'rscwo', 'idnsname': 'rscwo', 'idnszoneactive': 'rscwo',
'idnsforwarders': 'rscwo', 'idnsforwardpolicy': 'rscwo',
'nsaccountlock': 'rscwo'}
objectclass: top, idnsforwardzone
but:
-> $ host c8kubernode2.private.lot
Host c8kubernode2.private.lot not found: 2(SERVFAIL)
and when I'm looking at the forwarded-to server(also IPA) it
does _not_ seem like queries even get to it.
This got me pretty puzzled and only thing gets me suspicious
is - forwarding-from & forwarded-to are on the same IP
subnet and IPA is silently unhappy about it?
What else it can be?
many thanks, L.
1 year, 2 months
Setting up authentication for apache webserver.
by Simon Matthews
I am trying to follow the instructions on this page:
https://www.freeipa.org/page/Apache_Group_Based_Authorization
Because I want to only grant access to the web resources and not logins and because the load can often be heavy, I am trying use the mod_authnz_ldap setup. I don't have any virtual host configuration on the web servers.
I have a basic setup of IPA and have been able to add users and modify them through the ipa web interface.
When I try to run the command:
ldapmodify -h ipa01.example.com -p 389 -x -D "cn=Directory Manager" -w <DM Password> -f httpbind.ldif
I get the result:
ldap_modify: No such object (32)
Naturally, I changed the "dc=example,dc=com" to "dc=a,dc=b,dc=c", where I set up my ipa installation as "a.b.c".
1 year, 2 months
Fresh freeipa instance (2 node cluster) does not start anymore
by Jan Arnold
Hello,
I'm facing an issue with my newly setup freeipa instance. I narrowed it down to the following:
on each node there are two instances of the dirsrv running
systemctl output:
● dirsrv(a)my-name-NET.service loaded failed failed 389 Directory Server my-name-NET.
● dirsrv(a)my-name.NET.service loaded failed failed 389 Directory Server my-name.NET.
I don't know where these two instances are "defined". I assume to be able to just delete the "old" instance name.
The Instance my-name.NET does not find its config directory
/etc/dirsrv/slapd-my-name.NET/dse.ldif
The Instance my-name-NET does not start due to
Shutting down due to possible conflicts with other slapd processes
As this is a fresh install, I can reinstall, but would like to understand.
1 year, 2 months
shutdown/poweroff freeipa hang if replication exists?
by Harry G. Coin
For the last few months, shutdown/poweroff of freeipa server systems
hangs until systemd forcibly terminates freeipa. During that time I see
ns-slapd at nearly full CPU consumption. I see log entries such as:
ipa-dnskeysyncd[1578]: ipaserver.dnssec.syncrepl
even though there are no domains with dnssec active (though it is
installed).
Upon restart, freeipa complains of 'unclean shutdown' or similar, every
time.
Is anyone else seeing this? Is there an answer to this?
Thanks
Harry Coin
1 year, 2 months
CA_UNREACHABLE
by Johannes Beichter
Hi, I'm having trouble with certificate renewal for a web server:
[admin@somehost ~]$ sudo ipa-getcert list
Number of certificates and requests being tracked: 1.
Request ID '20200102214804':
status: CA_UNREACHABLE
ca-error: Server at https://ipaserver.somedomain.local/ipa/xml failed request, will retry: 4016 (RPC failed at server. Failed to authenticate to CA REST API).
stuck: no
key pair storage: type=FILE,location='/etc/ssl/certs/server.key'
certificate: type=FILE,location='/etc/ssl/certs/server.crt'
CA: IPA
issuer: CN=Certificate Authority,O=SOMEDOMAIN.LOCAL
subject: CN=somehost.somedomain.local,O=SOMEDOMAIN.LOCAL
expires: 2022-01-02 21:48:05 UTC
dns: somehost.somedomain.local
principal name: HTTP/somehost.somedomain.local(a)SOMEDOMAIN.LOCAL
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command:
track: yes
auto-renew: yes
With the help of the blog post at https://floblanc.wordpress.com/2016/12/19/troubleshooting-certmonger-issu... I found this in the Apache logs of ipaserver:
access_log:
192.168.0.47 - - [09/Jan/2022:21:07:59 +0100] "POST /ipa/xml HTTP/1.1" 401 2719
192.168.0.122 - - [09/Jan/2022:21:07:59 +0100] "GET /ca/rest/account/login HTTP/1.1" 403 631
192.168.0.47 - host/somehost.somedomain.local(a)SOMEDOMAIN.LOCAL [09/Jan/2022:21:07:59 +0100] "POST /ipa/xml HTTP/1.1" 200 312
error_log:
[Sun Jan 09 21:07:59.507131 2022] [ssl:error] [pid 3442:tid 140654399186688] [client 192.168.0.122:60104] AH: verify client post handshake
[Sun Jan 09 21:07:59.511918 2022] [wsgi:error] [pid 3437:tid 140654497466112] [remote 192.168.0.47:57158] ipa: INFO: [xmlserver] host/somehost.somedomain.local(a)SOMEDOMAIN.LOCAL: cert_request('...', principal='HTTP/somehost.somedomain.local(a)SOMEDOMAIN.LOCAL', add=True, version='2.51'): RemoteRetrieveError
What is the problem here or how can I find out?
I ran `ipa-certupdate` on both hosts but it didn't help.
Thanks for any support,
Johannes
1 year, 2 months
Automount fails with timeout / sssd (nss) failure
by Vinícius Ferrão
Hello
I've an IP client that almost always fails to mount autofs volumes. It seems to timeout after a while, since the volume almost always fails to mount: -bash: cd: /opt/ohpc/pub/apps: No such file or directory
I've observed that when I cd to a an autofs enabled directory sssd dump the following error messages regarding nss (attached at the end of this message).
I don't know where to start debugging this, if anyone have any insight I would be grateful.
Thanks.
==> sssd_nss.log <==
(2022-01-11 1:29:32): [nss] [sss_dp_get_account_domain_done] (0x0040): Data Provider Error: 3, 1432158301
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE:
* [nss] [become_user] (0x0200): Trying to become user [0][0].
* [nss] [become_user] (0x0200): Already user [0].
* [nss] [ldb] (0x0400): server_sort:Unable to register control with rootdse!
* (2022-01-11 1:28:23): [nss] [server_setup] (0x0400): CONFDB: /var/lib/sss/db/config.ldb
* (2022-01-11 1:28:23): [nss] [confdb_get_domain_internal] (0x0400): No enumeration for [implicit_files]!
* (2022-01-11 1:28:23): [nss] [confdb_get_domain_internal] (0x0400): Please note that when enumeration is disabled `getent passwd` does not return all users by design. See sssd.conf man page for more detailed information
* (2022-01-11 1:28:23): [nss] [confdb_get_domain_internal] (0x1000): pwd_expiration_warning is -1
* (2022-01-11 1:28:23): [nss] [confdb_get_domain_internal] (0x0400): No enumeration for [heisenberg.ilum.br]!
* (2022-01-11 1:28:23): [nss] [confdb_get_domain_internal] (0x0400): Please note that when enumeration is disabled `getent passwd` does not return all users by design. See sssd.conf man page for more detailed information
* (2022-01-11 1:28:23): [nss] [confdb_get_domain_internal] (0x1000): pwd_expiration_warning is -1
* (2022-01-11 1:28:23): [nss] [sss_get_etc_shells] (0x0400): Found shell /bin/sh in /etc/shells
* (2022-01-11 1:28:23): [nss] [sss_get_etc_shells] (0x0400): Found shell /bin/bash in /etc/shells
* (2022-01-11 1:28:23): [nss] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/sh in /etc/shells
* (2022-01-11 1:28:23): [nss] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/bash in /etc/shells
* (2022-01-11 1:28:23): [nss] [sss_get_etc_shells] (0x0400): Found shell /bin/rc in /etc/shells
* (2022-01-11 1:28:23): [nss] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/rc in /etc/shells
* (2022-01-11 1:28:23): [nss] [sss_get_etc_shells] (0x0400): Found shell /bin/csh in /etc/shells
* (2022-01-11 1:28:23): [nss] [sss_get_etc_shells] (0x0400): Found shell /bin/tcsh in /etc/shells
* (2022-01-11 1:28:23): [nss] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/csh in /etc/shells
* (2022-01-11 1:28:23): [nss] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/tcsh in /etc/shells
* (2022-01-11 1:28:23): [nss] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/fish in /etc/shells
* (2022-01-11 1:28:23): [nss] [sss_get_etc_shells] (0x0400): Found shell /bin/fish in /etc/shells
* (2022-01-11 1:28:23): [nss] [sss_names_init_from_args] (0x0100): Using re [(?P<name>[^@]+)@?(?P<domain>[^@]*$)].
* (2022-01-11 1:28:23): [nss] [sss_fqnames_init] (0x0100): Using fq format [%1$s@%2$s].
* (2022-01-11 1:28:23): [nss] [sbus_dbus_connect_address] (0x0400): Connected to unix:path=/var/lib/sss/pipes/private/sbus-dp_implicit_files bus as sssd.nss
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Introspectable on path /
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Introspectable on path /*
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Properties on path /
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Properties on path /*
* (2022-01-11 1:28:23): [nss] [sbus_watch_add] (0x2000): Created a disabled -/W watch on 11
* (2022-01-11 1:28:23): [nss] [sbus_watch_toggle] (0x4000): Toggle to enabled R/- watch on 11
* (2022-01-11 1:28:23): [nss] [sbus_router_listen] (0x0400): Registering signal listener org.freedesktop.DBus.NameOwnerChanged on path /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_router_listen] (0x0400): Registering signal listener org.freedesktop.DBus.NameAcquired on path /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface sssd.Responder.Domain on path /sssd
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface sssd.Responder.NegativeCache on path /sssd
* (2022-01-11 1:28:23): [nss] [sss_domain_get_state] (0x1000): Domain heisenberg.ilum.br is Active
* (2022-01-11 1:28:23): [nss] [sss_names_init_from_args] (0x0100): Using re [(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))].
* (2022-01-11 1:28:23): [nss] [sss_fqnames_init] (0x0100): Using fq format [%1$s@%2$s].
* (2022-01-11 1:28:23): [nss] [sbus_dbus_connect_address] (0x0400): Connected to unix:path=/var/lib/sss/pipes/private/sbus-dp_heisenberg.ilum.br bus as sssd.nss
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Introspectable on path /
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Introspectable on path /*
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Properties on path /
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Properties on path /*
* (2022-01-11 1:28:23): [nss] [sbus_watch_add] (0x2000): Created a disabled -/W watch on 12
* (2022-01-11 1:28:23): [nss] [sbus_watch_toggle] (0x4000): Toggle to enabled R/- watch on 12
* (2022-01-11 1:28:23): [nss] [sbus_router_listen] (0x0400): Registering signal listener org.freedesktop.DBus.NameOwnerChanged on path /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_router_listen] (0x0400): Registering signal listener org.freedesktop.DBus.NameAcquired on path /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface sssd.Responder.Domain on path /sssd
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface sssd.Responder.NegativeCache on path /sssd
* (2022-01-11 1:28:23): [nss] [sysdb_domain_init_internal] (0x0200): DB File for implicit_files: /var/lib/sss/db/cache_implicit_files.ldb
* (2022-01-11 1:28:23): [nss] [sysdb_domain_init_internal] (0x0200): Timestamp file for implicit_files: /var/lib/sss/db/timestamps_implicit_files.ldb
* (2022-01-11 1:28:23): [nss] [ldb] (0x0400): asq: Unable to register control with rootdse!
* (2022-01-11 1:28:23): [nss] [sysdb_domain_init_internal] (0x0200): DB File for heisenberg.ilum.br: /var/lib/sss/db/cache_heisenberg.ilum.br.ldb
* (2022-01-11 1:28:23): [nss] [sysdb_domain_init_internal] (0x0200): Timestamp file for heisenberg.ilum.br: /var/lib/sss/db/timestamps_heisenberg.ilum.br.ldb
* (2022-01-11 1:28:23): [nss] [ldb] (0x0400): asq: Unable to register control with rootdse!
* (2022-01-11 1:28:23): [nss] [sss_names_init_from_args] (0x0100): Using re [(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))].
* (2022-01-11 1:28:23): [nss] [sss_fqnames_init] (0x0100): Using fq format [%1$s@%2$s].
* (2022-01-11 1:28:23): [nss] [sss_process_init] (0x0400): Responder initialization complete (explicitly configured)
* (2022-01-11 1:28:23): [nss] [sss_domain_get_state] (0x1000): Domain heisenberg.ilum.br is Active
* (2022-01-11 1:28:23): [nss] [sss_domain_get_state] (0x1000): Domain heisenberg.ilum.br is Active
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/implicit_files/root@implicit_files] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GROUP/implicit_files/root@implicit_files] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_domain_get_state] (0x1000): Domain heisenberg.ilum.br is Active
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/heisenberg.ilum.br/root(a)heisenberg.ilum.br] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GROUP/heisenberg.ilum.br/root(a)heisenberg.ilum.br] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/UID/0] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GID/0] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface sssd.nss.MemoryCache on path /sssd
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface sssd.nss.MemoryCache on path /sssd
* (2022-01-11 1:28:23): [nss] [sss_mmap_cache_init] (0x0100): Fast 'PASSWD' mmap cache: memcache_timeout = 300, slots = 209712
* (2022-01-11 1:28:23): [nss] [sss_mmap_cache_init] (0x0100): Fast 'GROUP' mmap cache: memcache_timeout = 300, slots = 157284
* (2022-01-11 1:28:23): [nss] [sss_mmap_cache_init] (0x0100): Fast 'INITGROUPS' mmap cache: memcache_timeout = 300, slots = 262140
* (2022-01-11 1:28:23): [nss] [responder_set_fd_limit] (0x0100): Maximum file descriptors set to [8192]
* (2022-01-11 1:28:23): [nss] [sbus_dbus_connect_address] (0x0400): Connected to unix:path=/var/lib/sss/pipes/private/sbus-monitor bus as sssd.nss
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Introspectable on path /
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Introspectable on path /*
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Properties on path /
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Properties on path /*
* (2022-01-11 1:28:23): [nss] [sbus_watch_add] (0x2000): Created a disabled -/W watch on 26
* (2022-01-11 1:28:23): [nss] [sbus_watch_toggle] (0x4000): Toggle to enabled R/- watch on 26
* (2022-01-11 1:28:23): [nss] [sbus_router_listen] (0x0400): Registering signal listener org.freedesktop.DBus.NameOwnerChanged on path /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_router_listen] (0x0400): Registering signal listener org.freedesktop.DBus.NameAcquired on path /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_router_add_path] (0x0400): Registering interface sssd.service on path /sssd
* (2022-01-11 1:28:23): [nss] [nss_process_init] (0x0400): NSS Initialization complete
* (2022-01-11 1:28:23): [nss] [sss_domain_get_state] (0x1000): Domain heisenberg.ilum.br is Active
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameAcquired on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameAcquired on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameAcquired on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameAcquired on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_name_acquired] (0x0400): D-Bus name acquired: :1.2
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameAcquired: Success
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameAcquired on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_name_acquired] (0x0400): D-Bus name acquired: :1.2
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameAcquired: Success
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameAcquired on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_name_acquired] (0x0400): D-Bus name acquired: :1.9
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameAcquired: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_acquired] (0x0400): D-Bus name acquired: sssd.nss
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameAcquired: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_acquired] (0x0400): D-Bus name acquired: sssd.nss
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameAcquired: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_acquired] (0x0400): D-Bus name acquired: sssd.nss
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameAcquired: Success
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sss_dp_init_done] (0x0400): Client is registered with DP
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner :1.3 has changed from [] to [:1.3]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner :1.4 has changed from [] to [:1.4]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner sssd.pam has changed from [] to [sssd.pam]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner :1.5 has changed from [] to [:1.5]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner sssd.sudo has changed from [] to [sssd.sudo]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner :1.6 has changed from [] to [:1.6]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner sssd.autofs has changed from [] to [sssd.autofs]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner sssd.ssh has changed from [] to [sssd.ssh]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner :1.7 has changed from [] to [:1.7]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner sssd.pac has changed from [] to [sssd.pac]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sss_dp_init_done] (0x0400): Client is registered with DP
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner sssd.pam has changed from [] to [sssd.pam]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner :1.4 has changed from [] to [:1.4]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner sssd.sudo has changed from [] to [sssd.sudo]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner :1.5 has changed from [] to [:1.5]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner :1.6 has changed from [] to [:1.6]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner sssd.autofs has changed from [] to [sssd.autofs]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner sssd.ssh has changed from [] to [sssd.ssh]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner :1.7 has changed from [] to [:1.7]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_name_owner_changed] (0x4000): Name of owner sssd.pac has changed from [] to [sssd.pac]
* (2022-01-11 1:28:23): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sss_monitor_service_init_done] (0x0100): Got id ack and version (1) from Monitor
* (2022-01-11 1:28:23): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:28:23): [nss] [sss_domain_get_state] (0x1000): Domain heisenberg.ilum.br is Active
* (2022-01-11 1:28:23): [nss] [cache_req_domain_new_list_from_domain_resolution_order] (0x0400): Domain resolution order list: not set
* (2022-01-11 1:28:23): [nss] [sss_domain_get_state] (0x1000): Domain heisenberg.ilum.br is Active
* (2022-01-11 1:28:23): [nss] [sysdb_get_certmap] (0x0400): No certificate maps found.
* (2022-01-11 1:28:23): [nss] [sysdb_get_certmap] (0x0400): No certificate maps found.
* (2022-01-11 1:28:23): [nss] [sss_domain_get_state] (0x1000): Domain heisenberg.ilum.br is Active
* (2022-01-11 1:28:23): [nss] [sss_domain_get_state] (0x1000): Domain heisenberg.ilum.br is Active
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/implicit_files/root@implicit_files] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GROUP/implicit_files/root@implicit_files] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_domain_get_state] (0x1000): Domain heisenberg.ilum.br is Active
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/heisenberg.ilum.br/root(a)heisenberg.ilum.br] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GROUP/heisenberg.ilum.br/root(a)heisenberg.ilum.br] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/UID/0] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GID/0] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_domain_get_state] (0x1000): Domain heisenberg.ilum.br is Active
* (2022-01-11 1:28:23): [nss] [sss_domain_get_state] (0x1000): Domain heisenberg.ilum.br is Active
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/implicit_files/root@implicit_files] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GROUP/implicit_files/root@implicit_files] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_domain_get_state] (0x1000): Domain heisenberg.ilum.br is Active
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/heisenberg.ilum.br/root(a)heisenberg.ilum.br] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GROUP/heisenberg.ilum.br/root(a)heisenberg.ilum.br] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/UID/0] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GID/0] to negative cache permanently
* (2022-01-11 1:28:23): [nss] [sss_domain_get_state] (0x1000): Domain implicit_files is Active
* (2022-01-11 1:29:32): [nss] [get_client_cred] (0x4000): Client [0x5561b16647b0][27] creds: euid[0] egid[0] pid[3569] cmd_line['/usr/sbin/automount'].
* (2022-01-11 1:29:32): [nss] [get_client_cred] (0x0080): The following failure is expected to happen in case SELinux is disabled:
SELINUX_getpeercon failed [92][Protocol not available].
Please, consider enabling SELinux in your system.
* (2022-01-11 1:29:32): [nss] [setup_client_idle_timer] (0x4000): Idle timer re-set for client [0x5561b16647b0][27]
* (2022-01-11 1:29:32): [nss] [accept_fd_handler] (0x0400): Client [CID #1][cmd /usr/sbin/automount][0x5561b16647b0][27] connected!
* (2022-01-11 1:29:32): [nss] [sss_cmd_get_version] (0x0200): Received client version [1].
* (2022-01-11 1:29:32): [nss] [sss_cmd_get_version] (0x0200): Offered version [1].
* (2022-01-11 1:29:32): [nss] [nss_getby_id] (0x0400): Input ID: 0 (looking up 'POSIX data')
* (2022-01-11 1:29:32): [nss] [cache_req_set_plugin] (0x2000): CR #0: Setting "User by ID" plugin
* (2022-01-11 1:29:32): [nss] [cache_req_send] (0x0400): CR #0: REQ_TRACE: New request [CID #1] 'User by ID'
* (2022-01-11 1:29:32): [nss] [cache_req_select_domains] (0x0400): CR #0: Performing a multi-domain search
* (2022-01-11 1:29:32): [nss] [cache_req_search_domains] (0x0400): CR #0: Search will check the cache and check the data provider
* (2022-01-11 1:29:32): [nss] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/DOM_LOCATE_TYPE/implicit_files/User by ID]
* (2022-01-11 1:29:32): [nss] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/DOM_LOCATE_TYPE/heisenberg.ilum.br/User by ID]
* (2022-01-11 1:29:32): [nss] [cache_req_validate_domain_type] (0x2000): Request type POSIX-only for domain implicit_files type POSIX is valid
* (2022-01-11 1:29:32): [nss] [cache_req_set_domain] (0x0400): CR #0: Using domain [implicit_files]
* (2022-01-11 1:29:32): [nss] [cache_req_search_send] (0x0400): CR #0: Looking up UID:0@implicit_files
* (2022-01-11 1:29:32): [nss] [cache_req_search_ncache] (0x0400): CR #0: Checking negative cache for [UID:0@implicit_files]
* (2022-01-11 1:29:32): [nss] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/UID/implicit_files/0]
* (2022-01-11 1:29:32): [nss] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/UID/0]
* (2022-01-11 1:29:32): [nss] [cache_req_search_ncache] (0x0400): CR #0: [UID:0@implicit_files] does not exist (negative cache)
* (2022-01-11 1:29:32): [nss] [nss_get_object_send] (0x0400): Client [0x5561b16647b0][27][CID #1]: sent cache request #0
* (2022-01-11 1:29:32): [nss] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/DOM_LOCATE/NCE/UID/implicit_files/0]
* (2022-01-11 1:29:32): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/DOM_LOCATE/NCE/UID/implicit_files/0] to negative cache
* (2022-01-11 1:29:32): [nss] [sbus_dispatch] (0x4000): Dispatching.
* (2022-01-11 1:29:32): [nss] [sss_dp_get_account_domain_done] (0x0040): Data Provider Error: 3, 1432158301
********************** BACKTRACE DUMP ENDS HERE *********************************
(2022-01-11 1:29:32): [nss] [sss_dp_get_account_domain_done] (0x0040): Data Provider Error: 3, 1432158301
* ... skipping repetitive backtrace ...
(2022-01-11 1:29:32): [nss] [sss_dp_get_account_domain_done] (0x0040): Data Provider Error: 3, 1432158301
* ... skipping repetitive backtrace ...
(2022-01-11 1:29:32): [nss] [sss_dp_get_account_domain_done] (0x0040): Data Provider Error: 3, 1432158301
1 year, 2 months
Migrating from LDAP to FreeIPA
by Per Qvindesland
Hi We have just migrated from LDAP to FreeIPA with no problems, the only expected problems is the differences between UID and GID, I think I have solved most of it by running chown --from=user:group user:group * -R since we are using the same user and group names, so we only need to re-apply the same user and group names.I wondering if anyone could please share how they solved this, is there a better approach? RegardsPer
1 year, 2 months
Global Password Policy Change
by sdfdfeew fdshjnbfdx
I want to change the global password policy, but don't want to require users change their passwords, even if they might not be compliant.
Does anyone know what will happen if the global password policy is changed but passwords are not set to expire? I am hoping the policy will be in effect if a user changes their password, and for new users, but existing users who chose not to change their password will not impacted.
1 year, 2 months
ipa-healthcheck false positives
by Ronald Wimmer
Is it true that these "Errors" appear on an IPA server without CA role
present and can be ignored?
CRITICAL:
pki.server.healthcheck.certs.expiration.CASystemCertExpiryCheck: Invalid
PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.certs.expiration.KRASystemCertExpiryCheck:
Invalid PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.certs.expiration.OCSPSystemCertExpiryCheck:
Invalid PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.certs.expiration.TKSSystemCertExpiryCheck:
Invalid PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.certs.expiration.TPSSystemCertExpiryCheck:
Invalid PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.certs.trustflags.CASystemCertTrustFlagCheck:
Invalid PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.certs.trustflags.KRASystemCertTrustFlagCheck:
Invalid PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.certs.trustflags.OCSPSystemCertTrustFlagCheck:
Invalid PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.certs.trustflags.TKSSystemCertTrustFlagCheck:
Invalid PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.certs.trustflags.TPSSystemCertTrustFlagCheck:
Invalid PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.clones.connectivity_and_data.ClonesConnectivyAndDataCheck
CRITICAL: pki.server.healthcheck.meta.csconfig.CADogtagCertsConfigCheck:
Invalid PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.meta.csconfig.KRADogtagCertsConfigCheck: Invalid
PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.meta.csconfig.OCSPDogtagCertsConfigCheck: Invalid
PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.meta.csconfig.TKSDogtagCertsConfigCheck: Invalid
PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.meta.csconfig.TPSDogtagCertsConfigCheck: Invalid
PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.meta.connectivity.DogtagCACertsConnectivityCheck:
Invalid PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.meta.connectivity.DogtagKRAConnectivityCheck:
Invalid PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.meta.connectivity.DogtagOCSPConnectivityCheck:
Invalid PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.meta.connectivity.DogtagTKSConnectivityCheck:
Invalid PKI instance: pki-tomcat
CRITICAL:
pki.server.healthcheck.meta.connectivity.DogtagTPSConnectivityCheck:
Invalid PKI instance: pki-tomcat
CRITICAL: ipahealthcheck.ipa.roles.IPACRLManagerCheck: Unable to read
/var/lib/pki/pki-tomcat/conf/ca/CS.cfg
As well as these for a disabled trust domain?
ERROR: ipahealthcheck.ipa.trust.IPATrustDomainsCheck.domain-list:
/usr/sbin/sssctl domain-list reports mismatch: sssd domains mydomain.at,
buero.mydomain.at, org.mydomain.at trust domains buero.mydomain.at,
mydomain.at, org.mydomain.at, tk.mydomain.at
ERROR: ipahealthcheck.ipa.trust.IPATrustCatalogCheck.domain-status:
Execution of domain-status failed: CalledProcessError(Command
['/usr/sbin/sssctl', 'domain-status', 'tk.mydomain.at',
'--active-server'] returned non-zero exit status 1: 'Unable to get
online status\n')
Cheers,
Ronald
1 year, 2 months