Installing FreeIPA server + replica using Ansible Role FreeIPA
by Finn Fysj
The installation of IPA server and replica does not produce desired result.
Even though the mkhomedir is set to true the feature is not enabled in the authselect. Also the replica server does not replicate SUDO and HBAC rules from the IPA master.
Is the only solution to re-install the whole IPA server/replicas stuff? Kinda stupid.
Example of the IPA server role:
- role: freeipa.ansible_freeipa.ipaserver
vars:
ipaserver: "{{ ansible_hostname }}.example"
ipaserver_hostname: "{{ ansible_hostname }}.example"
ipaadmin_password: "test123"
ipadm_password: "test321"
ipaserver_domain: "example.com"
ipaserver_realm: "EXAMPLE.COM"
ipaserver_no_host_dns: true
ipaserver_mem_check: true
ipaserver_install_packages: true
ipaserver_setup_dns: false
ipaserver_no_pkinit: true
ipaserver_no_hbac_allow: true
ipaserver_no_ui_redirect: false
ipaclient_no_ntp: true
ipaclient_mkhomedir: true
ipaclient_no_sudo: false
6 months, 2 weeks
Current best practice: Backup/Restore?
by Harry G Coin
What's the 'current best practice' for what you might call a 'fully
deployed' freeipa install (meaning one that uses DNSSEC and all the
documented capability subsections)?
From what I can tell, there are two approaches:
Approach 1: Run it in a VM, then from time to time shut it down,
snapshot the 'known good' image, then bring the VM back up'. When
there's a problem that's not 'trivial', just revert to the 'known good'
snapshot and pay the price of re-entry of lost data.
The reasoning here is: Freeipa is much too interwoven among all the
sub-packages and dependency-hell, the time required to re-enter data
necessary to bring a backup current is at least known, compared to the
almost impossible-to-guess time and multi-package expertise required to
diagnosis much less cure problems in anything like the time available in
production environments.
Approach 2: Use the ipa-backup, ipa-restore commands. Just keep a
fresh install of the unconfigured pacakges, do ipa-restore and it will
get every single detail correct across all the available documented
functionality, databases, including the dnssec ones and the other
'trust' addons, etc.
The reasoning here is: It's better than approach 1 in that you don't
have to take down the system even for a moment to get a 'known good'
snapshot. However, you have to trust there is testing of 'everything
the ipa-backup ipa-restore' process does actually does test the whole of
the documented functionality.
For production reasons we'd prefer approach 2, as taking the system down
and bringing it back up as in approach 1 introduces a momentary loss of
capability but has the benefit of 'total confidence'. But is it really
'the best approach' in the production world?
Thanks!
6 months, 2 weeks
I need help with Replica installation.
by Alper AYKUT
Hello, I have a free ipa server with dns and ca integrated that is
currently running. Now I want to set up a replica server but I can't figure
out some parts. It gives an error when I want to set it up with the
following steps. How can I overcome this problem?
ipa-replica-install --setup-dns --setup-ca --mkhomedir
Lookup failed: Preferred host idm02ntp.tutel.lab does not provide DNS.
Reverse DNS resolution of address 101.45.58.172 (replica.lab.lab) failed.
Clients may not function properly. Please check your DNS setup. (Note that
this check queries IPA DNS directly and ignores /etc/hosts.)
thankyou.
6 months, 2 weeks
User missing after a restore of full backup
by Janez Molicnik
Hi!
While doing a yearly disaster recovery I encountered a strange issue, of the 749 users in production environment 748 got successfully imported, but one user is missing.
"kinit missing.username" just warns that the user was not found in Kerberos database while getting initial credentials.
"ipa user-find missing.username" says 0 users matched and WebUI shows there are just 748 users and doesn't see the missing one. It is also not present in "Stage users" or "Preserved users".
What logs can I check to troubleshoot this issue? There is nothing special about this user as far I can see. Password will expire next year, he is a member of admin group, but other admins got imported without issues.
The issue could also be connected to my next question: for security reasons we have disabled the system admin user (the FreeIPA build in account, the only member of "trust admins" group) - can this action interfere with full backup restore?
I did one restore like that and the admin and the missing user could not get the kerberos tickets - now I have enabled the admin user back again and made a full backup and then restored it - and admin account started to work (can log in), but then the issue with missing user arose. I am testing with a VirtualBox and I reverted the failed restore, so the missing user issue is not directly connected to the disabled admin. But it could be connected to admin user not being in the admin group? I suppose the admin user should be a member of admin group when doing restore? We probably also removed it from this group when disabling it - can anybody confirm, that the admin user is part of the admin group in default install?
6 months, 2 weeks
ipa CLI doesn't work due to revoked TGT following S4U2PROXY_NO_HEADER_PAC
by Kroon PC, Peter
Hi all,
After upgrading to Rocky linux 9.2 I'm running into issues with my IPA server (4.10.1-9.el9_2). In particular, my IPA CLI seems FUBARred:
$ kinit admin
Password for admin(a)EXAMPLE.COM:
$ ipa show-user admin
ipa: ERROR: Insufficient access: SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible (Credential cache is empty)
/var/log/krb5kdc.log:
okt 24 16:17:48 freeipa.example.com krb5kdc[10493]: TGS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes128-cts-hmac-sha1-96(17)}) 192.168.12.57: S4U2PROXY_NO_HEADER_PAC: authtime 0, etypes {rep=UNSUPPORTED:(0)} HTTP/freeipa.example.com(a)EXAMPLE.COM for ldap/freeipa.example.com(a)EXAMPLE.COM, TGT has been revoked
As the log shows, the KDC states there is no PAC, and therefore revokes the TGT (note, I had to RTFS to decipher the S4U2PROXY_NO_HEADER_PAC). Because of this, the web gui also doesn't work.
$ ldapsearch -Y GSSAPI -b cn=users,cn=accounts,dc=example,dc=nl "ipaNTSecurityIdentifier=*" uid ipaNTSecurityIdentifier
SASL/GSSAPI authentication started
SASL username: admin(a)EXAMPLE.COM
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <cn=users,cn=accounts,dc=example,dc=com> with scope subtree
# filter: ipaNTSecurityIdentifier=*
# requesting: uid ipaNTSecurityIdentifier
#
# admin, users, accounts, example.com
dn: uid=admin,cn=users,cn=accounts,dc=example,dc=com
uid: admin
ipaNTSecurityIdentifier: S-1-5-21-3777974847-1414448952-306354440-500
# search result
search: 4
result: 0 Success
# numResponses: 2
# numEntries: 1
Out of the ~200 or so users only the admin user has a ipaNTSecurityIdentifier, but I don't know if it's correct...
I can't run `ipa config-mod --enable-sid --add-sids`, since my ipa CLI is broken. I do still have LDAP access fortunately.
I tried to set `disable_pac = true` in /var/kerberos/krb5kdc/kdc.conf, but that results in the exact same error.
Setting ipaKrbAuthzData=None in cn=ipaConfig also has no effect.
Does anyone have any advice how to unbreak my installation? At this point I'd *like* to have PAC working, but I'd prefer a working IPA without PAC.
Many thanks,
Peter
6 months, 2 weeks
Re: backup / restore
by Frederic Ayrault
I think I removed too much certs, with CNRS2 certs in
/etc/dirsrv/slapd-LIX-POLYTECHNIQUE-FR,
ipa-ca-install works better but I still have an error at the end
> Done configuring certificate server (pki-tomcatd).
> ipaclient.install.ipa_certupdate: ERROR failed to update
> LIX.POLYTECHNIQUE.FR IPA CA in /etc/httpd/alias: Command
> '/usr/bin/certutil -d dbm:/etc/httpd/alias -A -n LIX.POLYTECHNIQUE.FR
> IPA CA -t CT,C,C -a -f /etc/httpd/alias/pwdfile.txt' returned non-zero
> exit status 255
>
>
> Your system may be partly configured.
> Run /usr/sbin/ipa-server-install --uninstall to clean up.
>
> Resubmitting certmonger request '20231013171553' timed out, please
> check the request manually
ipa-certupdate give similar errorr
> trying https://ipa3.lix.polytechnique.fr/ipa/json
> [try 1]: Forwarding 'schema' to json server
> 'https://ipa3.lix.polytechnique.fr/ipa/json'
> did not receive Kerberos credentials
> The ipa-certupdate command failed.
> [root@ipa3 ~]# kinit admin
> Password for admin(a)LIX.POLYTECHNIQUE.FR:
> [root@ipa3 ~]# ipa-certupdate
> trying https://ipa3.lix.polytechnique.fr/ipa/json
> [try 1]: Forwarding 'schema' to json server
> 'https://ipa3.lix.polytechnique.fr/ipa/json'
> trying https://ipa3.lix.polytechnique.fr/ipa/session/json
> [try 1]: Forwarding 'ca_is_enabled/1' to json server
> 'https://ipa3.lix.polytechnique.fr/ipa/session/json'
> [try 1]: Forwarding 'ca_find/1' to json server
> 'https://ipa3.lix.polytechnique.fr/ipa/session/json'
> failed to update LIX.POLYTECHNIQUE.FR IPA CA in /etc/httpd/alias:
> Command '/usr/bin/certutil -d dbm:/etc/httpd/alias -A -n
> LIX.POLYTECHNIQUE.FR IPA CA -t CT,C,C -a -f
> /etc/httpd/alias/pwdfile.txt' returned non-zero exit status 255
>
> Systemwide CA database updated.
> Systemwide CA database updated.
> The ipa-certupdate command was successful
>
and ipa-server-upgrade seem to work
> Upgrading IPA:. Estimated time: 1 minute 30 seconds
> [1/11]: stopping directory server
> [2/11]: saving configuration
> [3/11]: disabling listeners
> [4/11]: enabling DS global lock
> [5/11]: disabling Schema Compat
> [6/11]: starting directory server
> [7/11]: updating schema
> [8/11]: upgrading server
> [9/11]: stopping directory server
> [10/11]: restoring configuration
> [11/11]: starting directory server
> Done.
> Update complete
> Upgrading IPA services
> Upgrading the configuration of the IPA services
> [Verifying that root certificate is published]
> [Migrate CRL publish directory]
> Publish directory already set to new location
> [Verifying that CA proxy configuration is correct]
> [Verifying that KDC configuration is using ipa-kdb backend]
> [Fix DS schema file syntax]
> Syntax already fixed
> [Removing RA cert from DS NSS database]
> RA cert already removed
> [Enable sidgen and extdom plugins by default]
> [Updating HTTPD service IPA configuration]
> [Updating HTTPD service IPA WSGI configuration]
> Nothing to do for configure_httpd_wsgi_conf
> [Updating mod_nss protocol versions]
> Protocol versions already updated
> [Updating mod_nss cipher suite]
> [Updating mod_nss enabling OCSP]
> [Fixing trust flags in /etc/httpd/alias]
> [Moving HTTPD service keytab to gssproxy]
> [Removing self-signed CA]
> [Removing Dogtag 9 CA]
> [Checking for deprecated KDC configuration files]
> [Checking for deprecated backups of Samba configuration files]
> [Add missing CA DNS records]
> IPA CA DNS records already processed
> [Removing deprecated DNS configuration options]
> DNS is not configured
> [Ensuring minimal number of connections]
> DNS is not configured
> [Updating GSSAPI configuration in DNS]
> DNS is not configured
> [Updating pid-file configuration in DNS]
> DNS is not configured
> DNS is not configured
> DNS is not configured
> DNS is not configured
> DNS is not configured
> DNS is not configured
> DNS is not configured
> DNS is not configured
> [Upgrading CA schema]
> CA schema update complete (no changes)
> [Verifying that CA audit signing cert has 2 year validity]
> [Update certmonger certificate renewal configuration]
> Configuring certmonger to stop tracking system certificates for CA
> Certmonger certificate renewal configuration updated
> [Enable PKIX certificate path discovery and validation]
> [Authorizing RA Agent to modify profiles]
> [Authorizing RA Agent to manage lightweight CAs]
> [Ensuring Lightweight CAs container exists in Dogtag database]
> [Adding default OCSP URI configuration]
> pki-tomcat configuration changed, restart pki-tomcat
> [Ensuring CA is using LDAPProfileSubsystem]
> [Migrating certificate profiles to LDAP]
> [Ensuring presence of included profiles]
> [Add default CA ACL]
> Default CA ACL already added
> [Set up lightweight CA key retrieval]
> Creating principal
> Retrieving keytab
> Creating Custodia keys
> Configuring key retriever
> [Create systemd-user hbac service and rule]
> hbac service systemd-user already exists
> [Setup PKINIT]
> [Enable certauth]
> The IPA services were upgraded
> The ipa-server-upgrade command was successful
But ipactl status do not show pki-tomcatd Service
Thank you
Frederic
Frédéric AYRAULT
Administrateur Systèmes et Réseaux
Laboratoire d'Informatique de l'Ecole polytechnique
<http://www.lix.polytechnique.fr>
fred(a)lix.polytechnique.fr
Le 13/10/2023 à 17:31, Frederic Ayrault a écrit :
> Bonjour,
>
> Le 13/10/2023 à 10:24, Florence Blanc-Renaud a écrit :
>> Hi,
>>
>>
>> Your current situation: there was a self-signed IPA CA in one of the
>> servers, the replica was created without the CA role then extracted
>> from the original topology. This means there are traces of the CA
>> installation in the new replica but nothing to actually provide the
>> service.
>>
>> So my answer really depends on what you want to achieve. If the new
>> replica will never be connected any more to the previous topology,
>> you could follow Fraser's blog about Removing the CA from a FreeIPA
>> deployment
>> <https://frasertweedale.github.io/blog-redhat/posts/2019-10-24-removing-ip...>
>> on the replica after it has been removed from the original topology,
>> ensure that everything is cleanup and call ipa-ca-install on the new
>> replica. This would ensure there is a new CA private key completely
>> different from the original one. Please note that this blog provides
>> instructions but 1. this is not an officially supported procedure and
>> 2. the instructions intend to remove the CA, not reinstall a new one
>> later on.
>
> With Fraser's blog, I managed to remove some certs.
6 months, 2 weeks
When I create a user from the free ipa web interface, nfs autofs does not create my user directory.
by Alper AYKUT
When I create a user with free ipa using ipa tools, I can automount my home
directory on my nfs server without any problem.
However, when I want to create a user from the free ipa web interface, I
can create the user without any problem.
But when I want to connect from a client I get the following error message
As stated in the blog, if I create a user as follows
*ipa user-add --first ldapuser01 --last ldapuser01 --password
--shell=/bin/bash*
No matter which server I log in from with my user, it always maps to my nfs
automount home directory and my server.
But if I create a user via Free ipa my goal is to manage the operations
related to the users via free ipa web in order to make it easier. This time
the user is created. But I get the following error.
*could not chdir to home directory /home/ldapuser01: No such file or
directory*
*/usr/bin/xauth: error in locking authority file
/home/ldapuser01/.Xauthority-bash-4.2$ ls*
When I create a user from the Free ipa web interface, the login shell part
is " /bin/sh/ so could it be that it does not create my user directory?
When I create a user from the command prompt using ipa toos, the login
shell part of the user says /bin/bash.
How can I create login shell default bin/bash when user is created from
free ipa web interface?
6 months, 2 weeks
About creating User home directory via autofs on nfs server.
by Alper AYKUT
After creating nfs automount user I need to run the following command
continuously on my nfs server.
mkhomedir_helper user 077
Why is it not enough to create the home directory on my nfs server when I
create the user from the web interface. Is there any way not to use this
command after creating a user ?
thankyou.
6 months, 2 weeks
Free ipa takes a lot of time to add a user to a group from the web interface.
by Alper AYKUT
Hello, when I add a user to a group via free ipa, when I add a user to a
group, the user's addition to the group appears to be added in the web
interface. but it does not appear when I look through the server with *id
username.* It comes after a while but it takes a lot of time. What could be
the reason for this. Is there a way to speed this up? Or should I create a
user from the command prompt with ipa tools?
thankyou.
6 months, 2 weeks