September 2023 - FreeIPA-users - Fedora mailing-lists

Documentation on Upgrade FreeIPA to use TLS
by Marcelo Carvalho 25 Sep '23

25 Sep '23

Hi everybody. I am back in charge of some freeipa servers and would like to check for best documentation on upgrading FreeIPA to use TLS. I have found: https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/16… Is this the best I can find? Please any hint? Many thanks Marcelo

3 4

FreeIPA Trust with Microsoft Active Directory Domain Controllers.
by Marcelo Carvalho 25 Sep '23

25 Sep '23

I need to create a trust between a MS Domain Controller and my FreeIPA. Documentation I found is https://www.freeipa.org/page/Active_Directory_trust_setup Can anybody confirm that the above is the most recommended documentation related to FreeIPA Trust with Microsoft Active Directory Domain Controllers? Are there other documentation I should take in consideration? Please advise. Many thanks. Marcelo

3 2

Get running FreeIPA in Docker in Docker
by Jay Smith 25 Sep '23

25 Sep '23

For a test setup I try to get running a FreeIPA server within a docker container(DinD). But I get some errors and I don't know why. 1. Create docker in docker container => docker run --privileged -itd --name docker_swarm -v /sys/fs/cgroup:/sys/fs/cgroup docker 2. Connect to docker container and run the FreeIPA server => docker exec -it docker_swarm \ sh -c "docker run --sysctl net.ipv6.conf.all.disable_ipv6=0 --privileged=true --name ipa -ti -h ipa.example.test --cgroupns=host \ -v /sys/fs/cgroup:/sys/fs/cgroup:rw -v /tmp/freeipa-data:/data freeipa/freeipa-server:fedora-38-4.10.2 --skip-mem-check --no-ntp" The error I get is: docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: unable to apply cgroup configuration: failed to write 670: write /sys/fs/cgroup/docker/3c2cc48a075d3f62143d70718aefe4c55938e4332262894e67f31328eaa5a006/cgroup.procs: no such file or directory: unknown. ERRO[0038] error waiting for container: The command is working outside of Docker in Docker. Maybe it is possible to deactivated all the cgroups stuff? I don't need all features of FreeIPA just certificates, authentication(LDAP), DNS, ...

4 4

Migration of DNS Zones and it's records from one FreeIPA server to other
by Srikanth C 25 Sep '23

25 Sep '23

Hi, I am looking for the process to migrate the DNS Zones and it's records from one FreeIPA to other FreeIPA server. I have gone through the documentation but didn't find any automated way for this. Any idea how can we migrate? Thanks.

2 1

Managing FreeIPA installations without Trusts between them
by dweller dweller 25 Sep '23

25 Sep '23

We have a requirement to segregate different types of users, including customers, administrators, clients, and infrastructure hosts, into separate realms or unique IPA installations. While this is potentially feasible through the Trust feature, considering its ongoing development state, we're looking for alternative solutions. (see pic https://imgur.com/a/uqtbjly) Our objectives are: 1) Admin users within the ADMIN.NOVALOCAL realm should secure sudo access to hosts within the realms of CUSTOMER1.NOVALOCAL and CUSTOMER2.NOVALOCAL. 2) Admin users should also possess the capability to manage IPA entities within both customer installations of FreeIPA. We possess a rudimentary understanding of how to tackle the second objective. However, for the first one, our strategy is less clear. One available method is to instantiate hosts with a custom PAM configuration and administer access to administrators via the pam_ldap module. But we are also open to better suggestions if anyone can put forward.

2 3

FreeIPA PKI Certs wont renew "Adjustment limit exceeded"
by T A 22 Sep '23

22 Sep '23

On FreeIPA version 4.6.8-5 realized that pki-tomcatd wouldnt start ipactl status pki-tomcatd Service: STOPPED Ran 'getcert list' and found the 'pki-tomcat' cert was expired Rolled back the system clock to before the cert expired, now starts up ipactl status pki-tomcatd Service: STARTED Tried to renew with 'ipa-getcert resubmit -i "123456"' but it shows "status: CA_UNREACHABLE" 'ipa-cert fix' didnt work either Checked logs again 'journalctl -t certmonger' and found 'ns-slapd' was giving out this error when it tried to renew 'csngen_adjust_local_time - Adjustment limit exceeded: value - 435060 limit - 86400' Any way to change the adjustment limit or force this cert to renew anyway?

3 6

FreeIPA not starting
by Francis Augusto Medeiros-Logeay 22 Sep '23

22 Sep '23

Hi, I have a FreeIPA on a VM that I use for testing. I had to take a pause on my work with it, and after a few months, when I turn on the machine, FreeIPA won’t start. I get this error: [Fri Sep 22 18:31:03.162384 2023] [wsgi:error] [pid 2433:tid 2433] ModuleNotFoundError: No module named 'ipaserver.plugins.' [Fri Sep 22 18:31:03.183566 2023] [wsgi:error] [pid 2434:tid 2434] ipa: ERROR: Failed to start IPA: No module named 'ipaserver.plugins.' [Fri Sep 22 18:31:03.183611 2023] [wsgi:error] [pid 2434:tid 2434] mod_wsgi (pid=2434): Failed to exec Python script file '/usr/share/ipa/wsgi.py'. [Fri Sep 22 18:31:03.183634 2023] [wsgi:error] [pid 2434:tid 2434] mod_wsgi (pid=2434): Exception occurred processing WSGI script '/usr/share/ipa/wsgi.py'. [Fri Sep 22 18:31:03.184501 2023] [wsgi:error] [pid 2434:tid 2434] Traceback (most recent call last): [Fri Sep 22 18:31:03.184797 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/share/ipa/wsgi.py", line 28, in <module> [Fri Sep 22 18:31:03.184805 2023] [wsgi:error] [pid 2434:tid 2434] application = create_application() [Fri Sep 22 18:31:03.184810 2023] [wsgi:error] [pid 2434:tid 2434] ^^^^^^^^^^^^^^^^^^^^ [Fri Sep 22 18:31:03.184819 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipaserver/wsgi.py", line 51, in create_application [Fri Sep 22 18:31:03.184824 2023] [wsgi:error] [pid 2434:tid 2434] api.finalize() [Fri Sep 22 18:31:03.184831 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipalib/plugable.py", line 753, in finalize [Fri Sep 22 18:31:03.184836 2023] [wsgi:error] [pid 2434:tid 2434] self.__do_if_not_done('load_plugins') [Fri Sep 22 18:31:03.184844 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipalib/plugable.py", line 432, in __do_if_not_done [Fri Sep 22 18:31:03.184849 2023] [wsgi:error] [pid 2434:tid 2434] getattr(self, name)() [Fri Sep 22 18:31:03.184856 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipalib/plugable.py", line 633, in load_plugins [Fri Sep 22 18:31:03.184860 2023] [wsgi:error] [pid 2434:tid 2434] self.add_package(package) [Fri Sep 22 18:31:03.184867 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipalib/plugable.py", line 660, in add_package [Fri Sep 22 18:31:03.184872 2023] [wsgi:error] [pid 2434:tid 2434] module = importlib.import_module(name) [Fri Sep 22 18:31:03.184876 2023] [wsgi:error] [pid 2434:tid 2434] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [Fri Sep 22 18:31:03.184890 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib64/python3.11/importlib/__init__.py", line 126, in import_module [Fri Sep 22 18:31:03.184894 2023] [wsgi:error] [pid 2434:tid 2434] return _bootstrap._gcd_import(name[level:], package, level) [Fri Sep 22 18:31:03.184898 2023] [wsgi:error] [pid 2434:tid 2434] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [Fri Sep 22 18:31:03.184905 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1204, in _gcd_import [Fri Sep 22 18:31:03.184912 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1176, in _find_and_load [Fri Sep 22 18:31:03.184918 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1126, in _find_and_load_unlocked [Fri Sep 22 18:31:03.184925 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed [Fri Sep 22 18:31:03.184931 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1204, in _gcd_import [Fri Sep 22 18:31:03.184942 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1176, in _find_and_load [Fri Sep 22 18:31:03.184948 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1140, in _find_and_load_unlocked [Fri Sep 22 18:31:03.184964 2023] [wsgi:error] [pid 2434:tid 2434] ModuleNotFoundError: No module named 'ipaserver.plugins.’ This is weird, can you help me to get it back to a usable state? Best, Francis

2 2

Has anyone tried FreeIPA with RSA's SecurID® Authentication Agent for PAM ?
by White, Daniel E. (GSFC-770.0)[AEGIS] 22 Sep '23

22 Sep '23

Has anyone tried FreeIPA with RSA's SecurID® Authentication Agent for PAM ? https://community.rsa.com/t5/securid-authentication-agent-for/tkb-p/auth-ag…

1 0

Lost password for CA private key
by John Stokes 22 Sep '23

22 Sep '23

I have an IPA CA that is running fine for several years now. I also have two replicas installed. Today while creating a backup I realized I don't know the password for the file /root/cacert.p12 where the private key of the CA should be stored. The one I thought it should be (same as the pass for my admin user) does not seem to be working. Is there a way to reexport the private key of the CA? As I said everything is working fine and I have access to the server. If not how should I proceed? Should I destroy the whole CA and build a new one?

3 8

prevent 'sudo -i ' from executing
by Nathanaël Blanchet 21 Sep '23

21 Sep '23

Hello, I don't want my users to become root with simply executing the 'sudo -i' command so they can execute all root commands. Users should only execute with sudo the allowed defined commands. I'm able to prevent them from executing 'sudo su -', but I didn't find any informations about forbidding 'sudo -i'. Thank you for your help. -- Nathanaël Blanchet Administrateur Systèmes et Réseaux Service Informatique et REseau (SIRE) Département des systèmes d'information 227 avenue Professeur-Jean-Louis-Viala 34193 MONTPELLIER CEDEX 5 Tél. 33 (0)4 67 54 84 55 Fax 33 (0)4 67 54 84 14 blanchet(a)abes.fr

5 7

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2023