August 2023 - FreeIPA-users - Fedora Mailing-Lists

by Antonio Torres

The FreeIPA team would like to announce the FreeIPA 4.11.0 beta1 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. The full release notes can be found at: https://www.freeipa.org/release-notes/4-11-0-beta.html

9 months, 2 weeks

1
0
1 / 0

Segfault from dnssec-keyfroml

by Yavor Marinov

Hello all, I have a running IPA and replica 4.10 on Alma 9 and lately i can see some errors starting from ipa-ods-exporter and involving some other services. The error is constant on the master and obviously is spawned from starting ipa-ods-exporter. Below is the exact error from dnssec-keyfroml Aug 17 13:07:46 login.redacted.net kernel: dnssec-keyfroml[670202]: segfault at 18 ip 00007fdea693a284 sp 00007ffd544af608 error 4 in libsofthsm2.so[7fdea68a3000+9b000] Aug 17 13:07:46 login.redacted.net kernel: Code: 75 f4 48 8b 53 30 49 89 4c 24 20 49 89 44 24 10 49 89 54 24 28 48 83 c4 08 4c 89 e0 5b 41 5c c3 66 0f 1f 44 00 00 f3 0f 1e fa <48> 8b 47 18 48 85 c0 74 44 4c 8d 47 10 4c 89 c7 eb 12 66 2e 0f 1f The final error is from ip-dnskeysyncd and it is Aug 17 13:07:46 login.redacted.net ipa-dnskeysyncd[670193]: ipapython.ipautil.CalledProcessError: CalledProcessError(Command ['/usr/sbin/dnssec-keyfromlabel', '-E', 'pkcs11', '-K', '/var/named/dyndb-ldap/ipa/master/redacted.net/tmpo7cj2ohc', '-a', b'RSASHA256', '-l', b'pkcs11:object=76f06adc7594d5f0dbb882e271636a40;pin-source=/var/lib/ipa/dnssec/softhsm_pin', '-P', b'20230419122315', '-A', 'none', '-I', 'none', '-D', 'none', '-E', 'pkcs11', 'redacted.net.'] returned non-zero exit status -11: 'Found uninitialized token\nFound uninitialized token\nKey not found.\nPKCS11_load_public_key returned NULL\nFound uninitialized token\nKey not found.\nPKCS11_get_private_key returned NULL\ndnssec-keyfromlabel: warning: ENGINE_load_private_key failed (not found)\ndnssec-keyfromlabel: fatal: failed to get key redacted.net/RSASHA256: not found\n') I'm not quite sure where the main reason is, so that's why I'm asking here, and would appreciate your help on this Thanks

9 months, 2 weeks

2
4
0 / 0

Trying to install my own certificates on FreeIPA 4.10 (under IdM v11)

by Chris Cowan

I have been trying for several days to get a server up with certs from an Internal CA at work. I have We won't be using the IPA CA features. I just want to protect the https and ldaps connections. I have a server cert in pkcs7 format. My understanding is that I want to install with a pkcs12 file and pin that contains the server cert, key, and CA cert chain. (I have a rool and intermediate chain cert for the Internal CA). I'm also assuming that I will be setting enable_ra = False in /etc/ipa/default.conf My questions are: - Does anyone have an example of preparing the pkcs12 file from server cert and *.pem files for the CA? How can I check it for correctness? - Do I install normally and use the --http_pkcs12 and --dirsrv_pkcs12 options? (I found some dated instructions on sectigo.com that discuss using the --self-signed option on the installer, which is no longer there)

9 months, 2 weeks

2
3
0 / 0

Errors in dirsrv log

by Ranbir

I'm seeing errors like the ones below on my ipa servers (excuse the wrapping): [11/Aug/2023:22:07:37.684144411 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d5d558000400130000 [11/Aug/2023:22:07:37.686865097 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d5d8d00004003e0000 [11/Aug/2023:22:07:37.689902756 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d5dc51000700190000 [11/Aug/2023:22:07:37.693576614 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d5ff800005002d0000 [11/Aug/2023:22:07:37.696088129 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d60301000400380000 [11/Aug/2023:22:07:37.698351038 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d606800007000d0000 I can't find anything about what they mean. What do these errors mean? How do I resolve the problem? -- Ranbir

9 months, 3 weeks

3
4
0 / 0

Revisiting ancient history: AD Password Sync ?

by White, Daniel E. (GSFC-770.0)[AEGIS]

Can current FreeIPA sync passwords with Active Directory ? Thanks ______________________________________________________________________________________________ Daniel E. White NASCOM Linux Engineer, NASA Goddard Space Flight Center AEGIS Office: (301) 286-6919 Mobile: (240) 513-5290 daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov>

9 months, 3 weeks

3
2
0 / 0

IPA Permissions & ACI

by Super Tony

Hi, I have an IPA server running on RHEL 8.8. I added a subtree on top of my domain - cn=Multicast,dc=example,dc=com, and I need to be able to query anonymously for things that live underneath cn=Multicast, and give users that belong to cn=x500,cn=groups,cn=accounts,dc=example,dc=com write access. I am able to add ACI the traditional way against dn: cn=Multicast,dc=example,dc=com and make anonymous search plus write access work if I add it via ldapadd, however, I am unable to make it work the way I want it if I add the ACI via IPA Permissions from the IPA admin GUI. What am I missing here? Thanks!

9 months, 3 weeks

3
3
0 / 0

Creating permission to manage OTP Tokens

by spike

Hi, I've been trying to create a permission to allow certain users to manipulate all OTP Tokens. I found a post to this list from 2017 describing pretty much exactly what I want to do: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho... My permission object looks pretty much identical (at least I can't find any significant difference): $ ipa permission-show --all --raw "OTP Key Management" dn: cn=OTP Key Management,cn=permissions,cn=pbac,dc=rise,dc=fx cn: OTP Key Management ipapermright: all ipapermincludedattr: ipatokenTOTPtimeStep ipapermincludedattr: ipatokenOwner ipapermincludedattr: ipatokenOTPdigits ipapermincludedattr: ipatokenUniqueID ipapermincludedattr: ipatokenTOTPclockOffset ipapermincludedattr: ipatokenOTPkey ipapermbindruletype: permission ipapermlocation: cn=otp,dc=example,dc=com ipapermtargetfilter: (objectclass=ipatoken) ipapermissiontype: SYSTEM ipapermissiontype: V2 aci: (targetattr = "ipatokenOTPdigits || ipatokenOTPkey || ipatokenOwner || ipatokenTOTPclockOffset || ipatokenTOTPtimeStep || ipatokenUniqueID")(targetfilter = "(objectclass=ipatoken)")(version 3.0;acl "permission:OTP Key Management";allow (all) groupdn = "ldap:///cn=OTP Key Management,cn=permissions,cn=pbac,dc=example,dc=com";) member: cn=OTP Administrators,cn=privileges,cn=pbac,dc=example,dc=com memberindirect: uid=otpmaster,cn=users,cn=accounts,dc=example,dc=com memberindirect: cn=OTP Administrator,cn=roles,cn=accounts,dc=example,dc=com objectclass: top objectclass: groupofnames objectclass: ipapermission objectclass: ipapermissionv2 However, 'otptoken-find' doesn't return any tokens: $ kinit Password for otpmaster(a)EXAMPLE.COM: $ ipa otptoken-find -------------------- 0 OTP tokens matched -------------------- ---------------------------- Number of entries returned 0 ---------------------------- An ldapsearch with "(objectclass=ipatoken)" also returns no result. It all works fine if I run this as a user that is a member of the "admins" group or add "otpmaster" to "admins". Any pointers are greatly appreciated. I'm running FreeIPA 4.6.8 on CentOS 7.9.2009. Cheers!

9 months, 3 weeks

2
4
0 / 0

In FreeIPA AD trust environment add AD user to local group

by Sameer Gurung

I have integrated freeipa with AD via a two way trust. However I now have a problem How do I add my AD users logging in to linux clients to the local machines docker group so that they can run docker. Any help would be appreciated. Thanks everyone! Sameer K Gurung -- This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. Saint Mary's College, Shillong, Meghalaya, India-793003, smcs.ac.in <http://smcs.ac.in>

9 months, 3 weeks

3
9
0 / 0

ipaserver.ipa.1017.abc can not serve DNS for 1017.abc

by Alan Latteri

Hello, If I setup FreeIPA with hostname ipaserver.ipa.1017.abc, in domain ipa.example.com and realm IPA.1017.ABC. Adding zone example.com and adding hosts, DNS will not be served for that domain. But any other sub domain works fine. [root@ipa01 ~]# dig wiki.1017.abc 10.55.2.2 ; <<>> DiG 9.16.23-RH <<>> wiki.1017.abc 10.55.2.2 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 65453 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ; COOKIE: 98ad25b62ae02fbf0100000064c976f98f0bb284cff55564 (good) ;; QUESTION SECTION: ;wiki.1017.abc. IN A ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue Aug 01 14:19:53 PDT 2023 ;; MSG SIZE rcvd: 70 ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 17316 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ; COOKIE: 98ad25b62ae02fbf0100000064c976f98f0bb284cff55564 (good) ;; QUESTION SECTION: ;10.55.2.2. IN A ;; AUTHORITY SECTION: . 10383 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2023080101 1800 900 604800 86400 ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue Aug 01 14:19:53 PDT 2023 ;; MSG SIZE rcvd: 141 SUBDOMAIN: [root@ipa01 ~]# dig wiki.subdomain.1017.abc 10.55.2.2 ; <<>> DiG 9.16.23-RH <<>> wiki.subdomain.1017.abc 10.55.2.2 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5330 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ; COOKIE: 9899110f224ed1b50100000064c977e5b4a104105f8ddb27 (good) ;; QUESTION SECTION: ;wiki.subdomain.1017.abc. IN A ;; ANSWER SECTION: wiki.subdomain.1017.abc. 86400 IN A 10.55.253.2 ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue Aug 01 14:23:49 PDT 2023 ;; MSG SIZE rcvd: 96 ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 45756 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ; COOKIE: 9899110f224ed1b50100000064c977e5b4a104105f8ddb27 (good) ;; QUESTION SECTION: ;10.55.2.2. IN A ;; AUTHORITY SECTION: . 10786 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2023080101 1800 900 604800 86400 ;; Query time: 1 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue Aug 01 14:23:49 PDT 2023 ;; MSG SIZE rcvd: 141

9 months, 3 weeks

3
11
2 / 1

After "writeback to ldap failed" -- silent total freeipa failure / deadlock.

by Harry G Coin

This January, Mark Potter first experienced what is now killing my new freeipa setup as well. Once the primary server on which dns records are being programatically added sees named-pcks11 putting "writeback to ldap failed" in the log: 'systemctl' reports nothing amiss yet ns-slapd becomes entirely unresponsive and all that depend upon dirsrv hangs/times out. There is nothing in any of the log entries detailing failure, even with ample memory and storage space and processor resources. There are perhaps 10 hosts in the little lab sandbox, while the system does service DNS requests from the public internet. I looked through the 'changelogs' and could find nothing that seems to address this, is there a 'work-around' known? I'd like to avoid using 'bleeding edge' versions of freeipa. The details of Mark's discussion are here: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah... What's common to his and my case is that the problem arises during an 'initial programmatic load' of many DNS records in a few dozen zones (often ~200 / in a *.arpa domain), even when slowed to not more than one every 8 seconds. But only when at least one replication agreement exists. It's possible the fact that dnssec is enabled and so 'adding a record' generates further signature set computing activity either provides ldap/bind9 server load that exposes the race-condition-feeling problem or (less likely) is directly involved in the cause. I agree with Mark's quote: "Are we going to see everything fail in a spectacular manner and is there anything I can do to mitigate the failure with adding DNS entries as I still need to complete the addition and have ~5k per zone left for two zones." He 'worked around' the problem by adding a record at a time and slowly (without knowing what 'slowly' means in seconds). I'm unable to guess what 'slowly' means in my setup, but it appears to be more than 8 seconds / update, so fails for me. Maybe some kind of 'flow control' is required, or a some way to determine whether all replication activity and triggered further 'signature computation' dns activity has concluded after writing a new dns record? The only 'way out' is to restart ipa. Of some interest, when that is attempted after these failures, ns-slapd uses 100% CPU, dirsrv hang for several minutes, often longer than the systemctl shutdown / reboot process allows before forcibly killing the process. This is 100% repeatable. After a few dozen records are loaded, ns-slapd just stops responding. The program adding the records is using the python ldap2 interface native on the local host. Some further details: Aug 06 15:58:58 registry1.1.somedomain.com named-pkcs11[1497]: zone 177.168.192.in-addr.arpa/IN: sending notifies (serial 1691355538) Aug 06 15:58:58 registry1.1.somedomain.com myprogram.py[35998]: rssmain: ipa command dnsrecord_show: Summary: None args: ('7.somedomain.com.', 'email19') Aug 06 15:59:01 registry1.1.somedomain.com named-pkcs11[1497]: checkhints: unable to get root NS rrset from cache: not found Aug 06 15:59:06 registry1.1.somedomain.com myprogram.py[35998]: rssmain: ipa command dnsrecord_add: Summary: None Aug 06 15:59:07 registry1.1.somedomain.com myprogram.py[35998]: rssmain: ipa command dnsrecord_find: Summary: None args: ('177.168.192.in-addr.arpa.',), 144 records total Aug 06 15:59:07 registry1.1.somedomain.com myprogram.py[35998]: rssmain: ipa command dnsrecord_show: Summary: None args: ('177.168.192.in-addr.arpa.', '147') Aug 06 15:59:07 registry1.1.somedomain.com myprogram.py[35998]: rssmain: ipa command dnsrecord_find: Summary: None args: ('6.0.c.0.0.0.0.0.0.0.0.1.0.0.c.f.ip6.arpa.',), 22 records total Aug 06 15:59:07 registry1.1.somedomain.com ns-slapd[1434]: [06/Aug/2023:15:59:07.848595593 -0500] - WARN - content-sync-plugin - sync_update_persist_betxn_pre_op - DB retried operation targets "changenumber=59921,cn=changelog" (op=0x7f6b6fc1f400 idx_pl=0) => op not c> Aug 06 15:59:16 registry1.1.somedomain.com myprogram.py[35998]: rssmain: ipa command dnsrecord_add: Summary: None Aug 06 15:59:16 registry1.1.somedomain.com myprogram.py[35998]: rssmain: ipa command dnsrecord_show: Summary: None args: ('7.somedomain.com.', 'email19') Aug 06 15:59:32 registry1.1.somedomain.com named-pkcs11[1497]: zone 7.somedomain.com/IN (unsigned): serial (1691355547) write back to LDAP failed Aug 06 15:59:33 registry1.1.somedomain.com named-pkcs11[1497]: zone 7.somedomain.com/IN (signed): serial 1691355547 (unsigned 1691355547) Aug 06 15:59:33 registry1.1.somedomain.com named-pkcs11[1497]: zone 7.somedomain.com/IN (signed): sending notifies (serial 1691355547) Aug 06 16:01:01 registry1.1.somedomain.com CROND[52537]: (root) CMD (run-parts /etc/cron.hourly) Aug 06 16:01:01 registry1.1.somedomain.com run-parts[52540]: (/etc/cron.hourly) starting 0anacron Aug 06 16:01:01 registry1.1.somedomain.com run-parts[52546]: (/etc/cron.hourly) finished 0anacron Aug 06 16:02:05 registry1.1.somedomain.com sssd_kcm[19097]: Shutting down (status = 0) Aug 06 16:02:05 registry1.1.somedomain.com systemd[1]: sssd-kcm.service: Succeeded. Aug 06 16:02:20 registry1.1.somedomain.com systemd[1]: loclibrary.mount: Succeeded. Aug 06 16:02:20 registry1.1.somedomain.com systemd[1]: qflibrary.mount: Succeeded. Aug 06 16:07:37 registry1.1.somedomain.com sssd_be[659]: GSSAPI client step 1 Aug 06 16:07:37 registry1.1.somedomain.com sssd_be[659]: GSSAPI client step 1 Aug 06 16:08:34 registry1.1.somedomain.com named-pkcs11[1497]: zone 9.somedomain.com/IN (signed): Key 9.somedomain.com/RSASHA256/60467 missing or inactive and has no replacement: retaining signatures. Aug 06 16:08:34 registry1.1.somedomain.com named-pkcs11[1497]: zone 9.somedomain.com/IN (signed): sending notifies (serial 1691350608) Aug 06 16:09:08 registry1.1.somedomain.com sssd_be[659]: GSSAPI client step 1 Aug 06 16:09:08 registry1.1.somedomain.com sssd_be[659]: GSSAPI client step 1 Aug 06 16:09:18 registry1.1.somedomain.com sssd_be[659]: GSSAPI client step 1 Aug 06 16:09:18 registry1.1.somedomain.com sssd_be[659]: GSSAPI client step 1 Aug 06 16:09:30 registry1.1.somedomain.com sssd_be[659]: GSSAPI client step 1 Aug 06 16:09:30 registry1.1.somedomain.com sssd_be[659]: GSSAPI client step 1 Aug 06 16:11:05 registry1.1.somedomain.com sssd_be[659]: Backend is offline Aug 06 16:11:38 registry1.1.somedomain.com named-pkcs11[1497]: zone 3.somedomain.com/IN (signed): Key 3.somedomain.com/RSASHA256/18257 missing or inactive and has no replacement: retaining signatures. Aug 06 16:11:38 registry1.1.somedomain.com named-pkcs11[1497]: zone 3.somedomain.com/IN (signed): sending notifies (serial 1691350754) Aug 06 16:12:37 registry1.1.somedomain.com named-pkcs11[1497]: zone 7.somedomain.com/IN (signed): Key 7.somedomain.com/RSASHA256/40511 missing or inactive and has no replacement: retaining signatures. Aug 06 16:12:37 registry1.1.somedomain.com named-pkcs11[1497]: zone 7.somedomain.com/IN (signed): sending notifies (serial 1691355548) Aug 06 16:20:01 registry1.1.somedomain.com CROND[52573]: (root) CMD (test -f /var/lock/subsys/ods-enforcerd && kill -s SIGHUP `cat /var/run/opendnssec/enforcerd.pid` > /dev/null 2> /dev/null) Aug 06 16:29:21 registry1.1.somedomain.com systemd[1]: Stopping 389 Directory Server 1-somedomain-COM.... Aug 06 16:29:21 registry1.1.somedomain.com ns-slapd[1434]: [06/Aug/2023:16:29:21.659348276 -0500] - INFO - op_thread_cleanup - slapd shutting down - signaling operation threads - op stack size 0 max work q size 600 max work q stack size 4 Aug 06 16:29:21 registry1.1.somedomain.com ns-slapd[1434]: [06/Aug/2023:16:29:21.735442997 -0500] - INFO - slapd_daemon - slapd shutting down - waiting for 16 threads to terminate Aug 06 16:29:22 registry1.1.somedomain.com ns-slapd[1434]: [06/Aug/2023:16:29:22.278851959 -0500] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToregistry2.1.somedomain.com" (registry2:389): Attempting to release replica, but unable to receive endRe> Aug 06 16:29:22 registry1.1.somedomain.com ns-slapd[1434]: [06/Aug/2023:16:29:22.307800436 -0500] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToregistry2.1.somedomain.com" (registry2:389): Unable to receive the response for a startReplication ext> Aug 06 16:34:03 registry1.1.somedomain.com ods-enforcerd[2124]: [enforcer] update zone: _domainkey.anotherdomain.com Aug 06 16:34:04 registry1.1.somedomain.com ods-enforcerd[2124]: [signconf_cmd] performing signconf for zone _domainkey.anotherdomain.com Aug 06 16:34:04 registry1.1.somedomain.com ods-enforcerd[2124]: [signconf_cmd] signconf done for zone _domainkey.anotherdomain.com, notifying signer Aug 06 16:34:04 registry1.1.somedomain.com systemd[1]: Started IPA OpenDNSSEC Signer replacement. Aug 06 16:34:07 registry1.1.somedomain.com ipa-ods-exporter[52623]: ipa-ods-exporter: INFO To increase debugging set debug=True in dns.conf See default.conf(5) for details Aug 06 16:34:11 registry1.1.somedomain.com ipa-ods-exporter[52623]: Traceback (most recent call last): Aug 06 16:34:11 registry1.1.somedomain.com ipa-ods-exporter[52623]: File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1085, in error_handler Aug 06 16:34:11 registry1.1.somedomain.com ipa-ods-exporter[52623]: yield Aug 06 16:34:11 registry1.1.somedomain.com ipa-ods-exporter[52623]: File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1257, in gssapi_bind Aug 06 16:34:11 registry1.1.somedomain.com ipa-ods-exporter[52623]: '', auth_tokens, server_controls, client_controls) Aug 06 16:34:11 registry1.1.somedomain.com ipa-ods-exporter[52623]: File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 476, in sasl_interactive_bind_s Aug 06 16:34:11 registry1.1.somedomain.com ipa-ods-exporter[52623]: return self._ldap_call(self._l.sasl_interactive_bind_s,who,auth,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls),sasl_flags) Aug 06 16:34:11 registry1.1.somedomain.com ipa-ods-exporter[52623]: File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 340, in _ldap_call Aug 06 16:34:11 registry1.1.somedomain.com ipa-ods-exporter[52623]: reraise(exc_type, exc_value, exc_traceback) Aug 06 16:34:11 registry1.1.somedomain.com ipa-ods-exporter[52623]: File "/usr/lib64/python3.6/site-packages/ldap/compat.py", line 46, in reraise Aug 06 16:34:11 registry1.1.somedomain.com ipa-ods-exporter[52623]: raise exc_value Aug 06 16:34:11 registry1.1.somedomain.com ipa-ods-exporter[52623]: File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 324, in _ldap_call Aug 06 16:34:11 registry1.1.somedomain.com ipa-ods-exporter[52623]: result = func(*args,**kwargs) Aug 06 16:34:11 registry1.1.somedomain.com ipa-ods-exporter[52623]: ldap.SERVER_DOWN: {'result': -1, 'desc': "Can't contact LDAP server", 'errno': 111, 'ctrls': [], 'info': 'Connection refused'} Name : ipa-server-common Version : 4.9.11 Release : 6.module_el8.8.0+3593+1210bde8.alma.1 Architecture : noarch Size : 621 k Source : ipa-4.9.11-6.module_el8.8.0+3593+1210bde8.alma.1.src.rpm Repository : appstream Summary : Common files used by IPA server ... Name : ipa-server-dns Version : 4.9.11 Release : 6.module_el8.8.0+3593+1210bde8.alma.1 Architecture : noarch Size : 197 k Source : ipa-4.9.11-6.module_el8.8.0+3593+1210bde8.alma.1.src.rpm Repository : appstream [root@registry2 ~]# uname -r 4.18.0-477.15.1.el8_8.x86_64

9 months, 3 weeks

4
13
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users August 2023