Allowing a user to manage a service's certificates
by Sam Morris
I'm looking into using <https://github.com/guilhem/freeipa-issuer> to
request certificates from FreeIPA on behalf of a (FreeIPA) service.
The project authenticates to the FreeIPA API with a specified username
and password:
<https://github.com/guilhem/freeipa-issuer/blob/174d145616a672b09d3fdb56b2...>
I presume this means that it's only possible for it to authenticate to
the FreeIPA API as a user, as opposed to a host or service.
That being the case, I am trying to lock things down as much as
possible, so that the user is only able to request certificates for a
single service.
I've had a read through Fraiser's excellent blog post
<https://frasertweedale.github.io/blog-redhat/posts/2015-09-02-freeipa-cer...>
which points me towards creating a CA ACL, which I've done.
The CA ACL links together the user, the service and for good measure I
specified the CA and the profile too. But it's not sufficient to allow a
certificate request to work, as when the issuer tries to ask for the
certificate:
Fail to request certificate: ACIError (2100): Insufficient access:
not allowed to perform operations: request certificate
Returning to the blog post, I gather I additionally need to grant the
following two permissions to the user:
* 'Request Certificate'
* 'System: Modify Services'
What I'd like to understand is the scope of these permissions.
Does 'Request certificate' merely unlock the ability to make requests
that are themselves constrained by CA ACLs? That being the case, this
permission alone doesn't let the user request certificates for any other
hosts or services, right?
As for 'System: Modify Services': I guess granting this permission will
allow the user to add certificates to *any* service? In which case, I
suppose I need to create a new privilege that allows the usercertificate
of a particular entry only to be modified. Are there any examples of
this?
Many thanks as always.
--
Sam Morris <https://robots.org.uk/>
PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9
2 years, 1 month
Freeipa Samba problem: ticket is likely out of date
by fujisan
I'm having trouble accessing a samba share from windows.
In the log file, it says "ticket is likely out of date", it is looking for
kvno 3 and the output of kvno is 4.
How can I update the ticket?
Thanks
Fuji
Server log:
[2022/05/13 12:05:35.353907, 1, pid=252383]
../../source3/librpc/crypto/gse.c:665(gse_get_server_auth_token)
gss_accept_sec_context failed with [Unspecified GSS failure. Minor code
may provide more information: Request ticket server
cifs/myserver.mydomain.local(a)MYDOMAIN.LOCAL kvno 3 not found in keytab;
ticket is likely out of date]
# kvno cifs/myserver.mydomain.local(a)MYDOMAIN.LOCAL
cifs/myserver.mydomain.local(a)MYDOMAIN.LOCAL: kvno = 4
# net conf list
[global]
create krb5 conf = no
workgroup = MYDOMAIN.LOCAL
netbios name = MYSERVER
realm = MYDOMAIN..LOCAL
dedicated keytab file = FILE:/etc/samba/samba.keytab
kerberos method = dedicated keytab
server role = IPA PRIMARY DOMAIN CONTROLLER
security = user
domain master = yes
domain logons = yes
log level = 2
max log size = 100000
log file = /var/log/samba/log.%m
rpc_server:epmapper = external
rpc_server:lsarpc = external
rpc_server:lsass = external
rpc_server:lsasd = external
rpc_server:samr = external
rpc_server:netlogon = external
rpc_server:tcpip = yes
rpc_daemon:epmd = fork
rpc_daemon:lsasd = fork
idmap config * : backend = tdb
idmap config * : range = 0 - 0
idmap config MYDOMAIN : backend = sss
idmap config MYDOMAIN : range = 1000 - 201000
max smbd processes = 1000
passdb backend = ipasam:ldapi://%2fvar%2frun%2fslapd-MYDOMAIN.-LOCAL.socket
ldapsam:trusted = yes
ldap group suffix = cn=groups,cn=accounts
ldap machine suffix = cn=computers,cn=accounts
ldap ssl = off
ldap suffix = dc=mydomain,dc=local
ldap user suffix = cn=users,cn=accounts
disable spoolss = yes
[myshare]
path = /data/myshare
read only = no
browseable = yes
guest ok = no
create mask = 0644
The pacquages installed are:
samba-4.14.12-0.fc34.x86_64
freeipa-client-common-4.9.6-4.fc34.noarch
freeipa-selinux-4.9.6-4.fc34.noarch
freeipa-common-4.9.6-4.fc34.noarch
freeipa-server-common-4.9.6-4.fc34.noarch
freeipa-healthcheck-core-0.10-1.fc34.noarch
freeipa-client-4.9.6-4.fc34.x86_64
freeipa-server-4.9.6-4.fc34.x86_64
freeipa-server-dns-4.9.6-4.fc34.noarch
freeipa-server-trust-ad-4.9.6-4.fc34.x86_64
freeipa-python-compat-4.9.6-4.fc34.noarch
2 years, 1 month
SASL to AD via IPA
by Mariusz Stysiak
Hello everyone,
I have a nice and working IPA v3 with trust to AD set up. On one of our smtp servers (with authentication against different LDAP via sssd) I have set a saslauthd service which binds to our ipa server on 636/tcp using credentials and certificate issued for specific ipa user. Sasl works perfectly well as long as I try to authenticate ipa users (who can be found with ipa-user command) even with 2FA enabled, yet it fails if I try to authenticate AD user who was 'imported' into IPA via 'ipa group-add-member' command and 'external group as a member of posix group' method. AD users can be seen using 'id' command and can be allowed to log on linux servers, execute sudo commands based on hbac rules and so on. Even freeradius with OTP works. Alas, no sasl.
I know that probably it would be wiser to set sasl to ask AD directly, but I am just curious if it is possible to make it work via IPA.
Best regards
2 years, 1 month
freeipa expired certificates
by john john
Hello,
I have a freeipa server (ipa-server-4.5.0-22.el7.centos.x86_64).
Сertificates expired in April 2022 and why certmonger did not renew them is not clear.
getcert list
Request ID '20180510155654':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=EXAMPLE.COM
subject: CN=IPA RA,O=EXAMPLE.COM
expires: 2024-03-07 17:47:25 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Request ID '20180510155804':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=EXAMPLE.COM
subject: CN=CA Audit,O=EXAMPLE.COM
expires: 2024-03-05 17:47:13 UTC
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20180510155805':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=EXAMPLE.COM
subject: CN=OCSP Subsystem,O=EXAMPLE.COM
expires: 2024-03-07 17:47:15 UTC
eku: id-kp-OCSPSigning
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20180510155806':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=EXAMPLE.COM
subject: CN=CA Subsystem,O=EXAMPLE.COM
expires: 2024-03-05 17:47:23 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20180510155807':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=EXAMPLE.COM
subject: CN=Certificate Authority,O=EXAMPLE.COM
expires: 2038-05-10 15:56:32 UTC
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20180510155808':
status: CA_UNREACHABLE
ca-error: Error 60 connecting to https://freeipa.example.com:8443/ca/agent/ca/profileReview: Peer certificate cannot be authenticated with given CA certificates.
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=EXAMPLE.COM
subject: CN=freeipa.example.com,O=EXAMPLE.COM
expires: 2022-04-15 04:47:25 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20180510155834':
status: CA_UNREACHABLE
ca-error: Server at https://freeipa.example.com/ipa/xml failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction, explaining: Failed connect to freeipa.example.com:443; Connection refused).
stuck: no
key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-EXAMPLE-COM/pwdfile.txt'
certificate: type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=EXAMPLE.COM
subject: CN=freeipa.example.com,O=EXAMPLE.COM
expires: 2022-04-25 20:55:59 UTC
dns: freeipa.example.com
principal name: ldap/freeipa.example.com(a)EXAMPLE.COM
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv EXAMPLE-COM
track: yes
auto-renew: yes
Request ID '20180510155907':
status: CA_UNREACHABLE
ca-error: Server at https://freeipa.example.com/ipa/xml failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction, explaining: Failed connect to freeipa.example.com:443; Connection refused).
stuck: no
key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=EXAMPLE.COM
subject: CN=freeipa.example.com,O=EXAMPLE.COM
expires: 2022-04-26 06:11:51 UTC
dns: freeipa.example.com
principal name: ldap/freeipa.example.com(a)EXAMPLE.COM
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_httpd
track: yes
auto-renew: yes
Request ID '20180510155922':
status: CA_UNREACHABLE
ca-error: Server at https://freeipa.example.com/ipa/xml failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction, explaining: Failed connect to freeipa.example.com:443; Connection refused).
stuck: no
key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
CA: IPA
issuer: CN=Certificate Authority,O=EXAMPLE.COM
subject: CN=freeipa.example.com,O=EXAMPLE.COM
expires: 2022-04-25 20:56:54 UTC
principal name: krbtgt/EXAMPLE.COM(a)EXAMPLE.COM
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-pkinit-KPKdc
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
track: yes
auto-renew: yes
Request ID '20180720144614':
status: CA_REJECTED
ca-error: Server at https://freeipa.example.com/ipa/xml denied our request, giving up: 2100 (RPC failed at server. Insufficient access: Insufficient 'add' privilege to add the entry 'krbprincipalname=HTTP/pb-freeipa(a)EXAMPLE.COM,cn=services,cn=accounts,dc=example,dc=cb,dc=com'.).
stuck: yes
key pair storage: type=FILE,location='/etc/pki/tls/private/pb-freeipa.key'
certificate: type=FILE,location='/etc/pki/tls/certs/pb-freeipa.crt'
CA: IPA
issuer:
subject:
expires: unknown
pre-save command:
post-save command:
track: yes
auto-renew: yes
Request ID '20180720151813':
status: NEED_KEY_GEN_PIN
stuck: yes
key pair storage: type=NSSDB,location='/etc/ipa/certdb',nickname='Server-Cert',pin set
certificate: type=NSSDB,location='/etc/ipa/certdb',nickname='Server-Cert'
CA: IPA
issuer:
subject:
expires: unknown
pre-save command:
post-save command:
track: yes
auto-renew: yes
Request ID '20180720152853':
status: CA_UNREACHABLE
ca-error: Server at https://freeipa.example.com/ipa/xml failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction, explaining: Failed connect to freeipa.example.com:443; Connection refused).
stuck: no
key pair storage: type=FILE,location='/etc/pki/tls/private/freeipa.example.com.key'
certificate: type=FILE,location='/etc/pki/tls/certs/freeipa.example.com.crt'
CA: IPA
issuer: CN=Certificate Authority,O=EXAMPLE.COM
subject: CN=freeipa.example.com,O=EXAMPLE.COM
expires: 2022-04-25 20:57:24 UTC
dns: freeipa.example.com
principal name: HTTP/freeipa.example.com(a)EXAMPLE.COM
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command:
track: yes
auto-renew: yes
Request ID '20180723075009':
status: NEED_CSR
stuck: no
key pair storage: type=FILE,location='/root/OVPN_CLIENT_1.key'
certificate: type=FILE,location='/root/OVPN_CLIENT_1.pem'
CA: IPA
issuer: CN=Certificate Authority,O=EXAMPLE.COM
subject: CN=freeipa.example.com,O=EXAMPLE.COM
expires: 2020-07-23 07:50:10 UTC
dns: freeipa.example.com
principal name: host/freeipa.example.com(a)EXAMPLE.COM
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command:
track: yes
auto-renew: yes
Request ID '20180723075356':
status: CA_REJECTED
ca-error: Server at https://freeipa.example.com/ipa/xml denied our request, giving up: 3009 (RPC failed at server. invalid 'csr': hostname in subject of request 'OVPN_CLIENT_1' does not match name or aliases of principal 'HTTP/freeipa.example.com(a)EXAMPLE.COM').
stuck: yes
key pair storage: type=FILE,location='/root/OVPN_CLIENT_2.key'
certificate: type=FILE,location='/root/OVPN_CLIENT_2.pem'
CA: IPA
issuer:
subject:
expires: unknown
pre-save command:
post-save command:
track: yes
auto-renew: yes
Request ID '20180723075553':
status: CA_UNREACHABLE
ca-error: Server at https://freeipa.example.com/ipa/xml failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction, explaining: Peer's Certificate has expired.).
stuck: no
key pair storage: type=FILE,location='/root/OVPN_CLIENT_3.key'
certificate: type=FILE,location='/root/OVPN_CLIENT_3.pem'
CA: IPA
issuer:
subject:
expires: unknown
pre-save command:
post-save command:
track: yes
auto-renew: yes
Request ID '20200514145151':
status: CA_UNREACHABLE
ca-error: Server at https://freeipa.example.com/ipa/xml failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction, explaining: Peer's Certificate has expired.).
stuck: no
key pair storage: type=FILE,location='/home/user/vpn-user.key'
certificate: type=FILE,location='/home/user/vpn-user.crt'
CA: IPA
issuer: CN=Certificate Authority,O=EXAMPLE.COM
subject: CN=freeipa.example.com,O=EXAMPLE.COM
expires: 2022-05-15 14:51:52 UTC
dns: freeipa.example.com
principal name: host/freeipa.example.com(a)EXAMPLE.COM
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command:
track: yes
auto-renew: yes
Request ID '20200514150206':
status: CA_UNREACHABLE
ca-error: Server at https://freeipa.example.com/ipa/xml failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction, explaining: Peer's Certificate has expired.).
stuck: no
key pair storage: type=FILE,location='/home/user/freeipa.example.com.key'
certificate: type=FILE,location='/home/user/freeipa.example.com.crt'
CA: IPA
issuer: CN=Certificate Authority,O=EXAMPLE.COM
subject: CN=freeipa.example.com,O=EXAMPLE.COM
expires: 2022-05-15 15:02:07 UTC
dns: freeipa.example.com
principal name: host/freeipa.example.com(a)EXAMPLE.COM
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command:
track: yes
auto-renew: yes
I tried to update the certificates using the information from the following links:
https://floblanc.wordpress.com/2016/12/06/using-certmonger-to-track-certi...
https://floblanc.wordpress.com/2016/12/19/troubleshooting-certmonger-issu...
https://listman.redhat.com/archives/freeipa-users/2017-January/msg00216.html
but it was not possible to update expired certificates.
Please would you tell how to solve the problem.
2 years, 1 month
Broken ipa replica
by Giulio Casella
Hi everyone,
I'm stuck with a broken replica. I had a setup with two ipa server in
replica (ipa-server-4.6.4 on CentOS 7.6), let's say "idc01" and "idc02".
Due to heavy load idc01 crashed many times, and was not working anymore.
So I tried to redo the replica again. At first I tried to
"ipa-replica-manage re-initialize", with no success.
Now I'm trying to redo from scratch the replica setup: on idc02 I
removed the segments (ipa topologysegment-del, for both ca and domain
suffix), on idc01 I removed everything (ipa-server-install --uninstall),
then I joined domain (ipa-client-install), and everything is working so far.
When doing "ipa-replica-install" on idc01 I get:
[...]
[28/41]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 22 seconds elapsed
[ldap://idc02.my.dom.ain:389] reports: Update failed! Status: [Error
(-11) connection error: Unknown connection error (-11) - Total update
aborted]
And on idc02 (the working server), in
/var/log/dirsrv/slapd-MY-DOM-AIN/errors I find lines stating:
[20/Mar/2019:09:28:06.545187923 +0100] - INFO - NSMMReplicationPlugin -
repl5_tot_run - Beginning total update of replica
"agmt="cn=meToidc01.my.dom.ain" (idc01:389)".
[20/Mar/2019:09:28:26.528046160 +0100] - ERR - NSMMReplicationPlugin -
perform_operation - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Failed
to send extended operation: LDAP error -1 (Can't contact LDAP server)
[20/Mar/2019:09:28:26.530763939 +0100] - ERR - NSMMReplicationPlugin -
repl5_tot_log_operation_failure - agmt="cn=meToidc01.my.dom.ain"
(idc01:389): Received error -1 (Can't contact LDAP server): for total
update operation
[20/Mar/2019:09:28:26.532678072 +0100] - ERR - NSMMReplicationPlugin -
release_replica - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Unable to
send endReplication extended operation (Can't contact LDAP server)
[20/Mar/2019:09:28:26.534307539 +0100] - ERR - NSMMReplicationPlugin -
repl5_tot_run - Total update failed for replica
"agmt="cn=meToidc01.my.dom.ain" (idc01:389)", error (-11)
[20/Mar/2019:09:28:26.561763168 +0100] - INFO - NSMMReplicationPlugin -
bind_and_check_pwp - agmt="cn=meToidc01.my.dom.ain" (idc01:389):
Replication bind with GSSAPI auth resumed
[20/Mar/2019:09:28:26.582389258 +0100] - WARN - NSMMReplicationPlugin -
repl5_inc_run - agmt="cn=meToidc01.my.dom.ain" (idc01:389): The remote
replica has a different database generation ID than the local database.
You may have to reinitialize the remote replica, or the local replica.
It seems that idc02 remembers something about the old replica.
Any hint?
Thank you in advance,
Giulio
2 years, 1 month
Re: EL8 ipa upgrade / Single Level Domain
by Alexander Bokovoy
On ke, 04 touko 2022, Angus Clarke via FreeIPA-users wrote:
>Thanks Flo,
>
>Are there any options available to me to continue using my existing
>FreeIPA deployment with EL8 clients and indeed to upgrade the FreeIPA
>infra to 4.7+ which I believe is only available to EL8 - manipulate the
>current single level domain/realm perhaps?
>
>Or am I faced with replacing the whole deployment with a fresh FreeIPA
>install using a permitted domain/realm?
The latter is the case, unfortunately. Manipulating domain/realm would
not be easy because Kerberos realm details are everywhere. Your LDAP
database suffix embeds it as well, as dc=single-label, that one is hard
to change. Kerberos realm is baked into all principals.
>
>I suppose the latter involves a large amount of work in
>exporting/importing users/groups/hbac/automember/sudo/<other>
>configurations and then having to re-register all of our existing
>clients (we have many) to the new infra.
It might be possible to migrate, kind of. I haven't tried that myself.
If you'd export LDAP data and modify LDAP suffix (dc=single-label ->
dc=new,dc=domain), modify all principals to use new realm, and all other
objects to use new domain, then do a data-only backup from the new
install, replace LDIF file in it with the modified version, re-import
that backup, then manually re-generate keytabs using LDAPI URI in
ipa-getkeytab (as root on IPA master this will allow you to be a
cn=Directory Manager), then it might work. I am not detailing the
process because a) I have not tried that, b) it is easy to break. But I
think it could be possible at least theoretically:
- your Kerberos master key would stay the same as part of the import so
you would be able to decrypt old Kerberos keys for old principals
- your user Kerberos principals use random salt, so they should not
depend on the realm value
- keytab files have to be rebuilt because they do have the Kerberos
principal name recorded in them, so they'd be issued into 'old' realm
All the users/groups/HBAC/sudo rules metadata is the same, it only
differs by the DN which is now ending in a different suffix which could
be fixed with LDIF replacement.
Restoring backup from the data would force wiping the 'new' deployment
content. You need this because you certainly want to keep old ID ranges,
DNA ranges, SIDs and other per-deployment settings.
Again, this is a theory. I haven't tried that myself.
>
>Thanks
>Angus
>________________________________
>From: Florence Blanc-Renaud via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
>Sent: 03 May 2022 13:37
>To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
>Cc: Angus Clarke <angus(a)charworth.com>; Florence Blanc-Renaud <flo(a)redhat.com>
>Subject: [Freeipa-users] Re: EL8 ipa upgrade / Single Level Domain
>
>Hi,
>
>
>On Tue, May 3, 2022 at 11:59 AM Angus Clarke via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> wrote:
>Hello
>
>We installed our IPA servers back in EL7.2 days and deployed with a single level domain and matching (uppercased) realm. Through various upgrades we are now at EL7.9 and are aware that the ipa-client-install command has become finickity about single level domains however thus far we have been able to continue joining EL7 clients.
>
>I've setup my test environment similarly and have been unsuccessful in trying to upgrade (join new and replace old) these EL7 Freeipa servers to EL8, the ipa-client-install on EL8 skips the single level domain so I'm a bit stuck.
>
>Is there a way around this in EL8?
>
>As you saw, the installation of single-label domain is forbidden since ipa-4.6.5-1.el7, but the upgrade from older versions is still allowed.
>Regarding the client, the installation in a single-label IPA domain is possible only with IPA 4.6.x clients (see https://bugzilla.redhat.com/show_bug.cgi?id=1745108<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzill...>). It was a deliberate choice to allow RHEL7 clients but stop supporting this type of deployment with RHEL8+. So no workaround with RHEL8...
>
>Hope this clarifies,
>flo
>
>EL7 ipa server (ipatest1):
>ipa-server-4.6.8-5.0.1.el7_9.10.x86_64
>
>EL8 (ipatest2):
>ipa-server-4.9.6-12.0.1.module+el8.5.0+20642+b228f286.x86_64
>
>
>[root@ipatest2 ~]# ipa-replica-install --setup-ca --ip-address 192.168.180.141 --password=Password1234 --principal=admin --setup-dns --forwarder=192.168.180.100
>Configuring client side components
>This program will set up IPA client.
>Version 4.9.6
>
>Unable to discover domain, not provided on command line
>The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information
>Removing client side components
>IPA client is not configured on this system.
>The ipa-client-install command failed.
>
>Your system may be partly configured.
>Run /usr/sbin/ipa-server-install --uninstall to clean up.
>
>Configuration of client side components failed!
>The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
>
>
>[root@ipatest2 ~]# less /var/log/ipaclient-install.log
><-- snip
>2022-05-03T08:53:10Z DEBUG [IPA Discovery]
>2022-05-03T08:53:10Z DEBUG Starting IPA discovery with domain=None, servers=None, hostname=ipatest2.int.test
>2022-05-03T08:53:10Z DEBUG Start searching for LDAP SRV record in "int.test" (domain of the hostname) and its sub-d
>omains
>2022-05-03T08:53:10Z DEBUG Search DNS for SRV record of _ldap._tcp.int.test
>2022-05-03T08:53:10Z DEBUG DNS record not found: NXDOMAIN
>2022-05-03T08:53:10Z DEBUG Search DNS for SRV record of _ldap._tcp.test
>2022-05-03T08:53:10Z DEBUG DNS record found: 0 100 389 ipatest1.int.test.
>2022-05-03T08:53:10Z DEBUG [Kerberos realm search]
>2022-05-03T08:53:10Z DEBUG Search DNS for TXT record of _kerberos.test
>2022-05-03T08:53:10Z DEBUG DNS record found: "TEST"
>2022-05-03T08:53:10Z DEBUG Skipping invalid realm 'TEST' (single label realms are not supported)
>2022-05-03T08:53:10Z DEBUG Search DNS for SRV record of _kerberos._udp.test
>2022-05-03T08:53:10Z DEBUG DNS record found: 0 100 88 ipatest1.int.test.
>2022-05-03T08:53:10Z DEBUG [LDAP server check]
>2022-05-03T08:53:10Z DEBUG Verifying that ipatest1.int.test (realm None) is an IPA server
>2022-05-03T08:53:10Z DEBUG Init LDAP connection to: ldap://ipatest1.int.test:389
>2022-05-03T08:53:10Z DEBUG Search LDAP server for IPA base DN
>2022-05-03T08:53:10Z DEBUG Check if naming context 'dc=test' is for IPA
>2022-05-03T08:53:10Z DEBUG Naming context 'dc=test' is a valid IPA context
>2022-05-03T08:53:10Z DEBUG Search for (objectClass=krbRealmContainer) in dc=test (sub)
>2022-05-03T08:53:10Z DEBUG Found: cn=TEST,cn=kerberos,dc=test
>2022-05-03T08:53:10Z DEBUG Skipping invalid realm 'TEST' (single label realms are not supported)
>2022-05-03T08:53:10Z DEBUG Discovery result: NOT_IPA_SERVER; server=None, domain=test, kdc=ipatest1.int.test, bas
>edn=dc=test
>2022-05-03T08:53:10Z DEBUG Validated servers:
>2022-05-03T08:53:10Z DEBUG No IPA server found
><-- snip
>
>
>Thanks
>Angus
>_______________________________________________
>FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>
>To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org>
>Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fe...>
>List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorap...>
>List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.f...>
>Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpagure....>
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
2 years, 1 month
Re: EL8 ipa upgrade / Single Level Domain
by Florence Blanc-Renaud
Hi,
On Tue, May 3, 2022 at 11:59 AM Angus Clarke via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
> Hello
>
> We installed our IPA servers back in EL7.2 days and deployed with a single
> level domain and matching (uppercased) realm. Through various upgrades we
> are now at EL7.9 and are aware that the ipa-client-install command has
> become finickity about single level domains however thus far we have been
> able to continue joining EL7 clients.
>
> I've setup my test environment similarly and have been unsuccessful in
> trying to upgrade (join new and replace old) these EL7 Freeipa servers to
> EL8, the ipa-client-install on EL8 skips the single level domain so I'm a
> bit stuck.
>
> Is there a way around this in EL8?
>
> As you saw, the installation of single-label domain is forbidden since
ipa-4.6.5-1.el7, but the upgrade from older versions is still allowed.
Regarding the client, the installation in a single-label IPA domain is
possible only with IPA 4.6.x clients (see
https://bugzilla.redhat.com/show_bug.cgi?id=1745108). It was a deliberate
choice to allow RHEL7 clients but stop supporting this type of deployment
with RHEL8+. So no workaround with RHEL8...
Hope this clarifies,
flo
> EL7 ipa server (ipatest1):
> ipa-server-4.6.8-5.0.1.el7_9.10.x86_64
>
> EL8 (ipatest2):
> ipa-server-4.9.6-12.0.1.module+el8.5.0+20642+b228f286.x86_64
>
>
> [root@ipatest2 ~]# ipa-replica-install --setup-ca --ip-address
> 192.168.180.141 --password=Password1234 --principal=admin --setup-dns
> --forwarder=192.168.180.100
> Configuring client side components
> This program will set up IPA client.
> Version 4.9.6
>
> Unable to discover domain, not provided on command line
> The ipa-client-install command failed. See /var/log/ipaclient-install.log
> for more information
> Removing client side components
> IPA client is not configured on this system.
> The ipa-client-install command failed.
>
> Your system may be partly configured.
> Run /usr/sbin/ipa-server-install --uninstall to clean up.
>
> Configuration of client side components failed!
> The ipa-replica-install command failed. See
> /var/log/ipareplica-install.log for more information
>
>
> [root@ipatest2 ~]# less /var/log/ipaclient-install.log
> <-- snip
> 2022-05-03T08:53:10Z DEBUG [IPA Discovery]
> 2022-05-03T08:53:10Z DEBUG Starting IPA discovery with domain=None,
> servers=None, hostname=ipatest2.int.test
> 2022-05-03T08:53:10Z DEBUG Start searching for LDAP SRV record in
> "int.test" (domain of the hostname) and its sub-d
> omains
> 2022-05-03T08:53:10Z DEBUG Search DNS for SRV record of _ldap._tcp.int.test
> 2022-05-03T08:53:10Z DEBUG DNS record not found: NXDOMAIN
> 2022-05-03T08:53:10Z DEBUG Search DNS for SRV record of _ldap._tcp.test
> 2022-05-03T08:53:10Z DEBUG DNS record found: 0 100 389 ipatest1.int.test.
> 2022-05-03T08:53:10Z DEBUG [Kerberos realm search]
> 2022-05-03T08:53:10Z DEBUG Search DNS for TXT record of _kerberos.test
> 2022-05-03T08:53:10Z DEBUG DNS record found: "TEST"
> 2022-05-03T08:53:10Z DEBUG Skipping invalid realm 'TEST' (single label
> realms are not supported)
> 2022-05-03T08:53:10Z DEBUG Search DNS for SRV record of _kerberos._udp.test
> 2022-05-03T08:53:10Z DEBUG DNS record found: 0 100 88 ipatest1.int.test.
> 2022-05-03T08:53:10Z DEBUG [LDAP server check]
> 2022-05-03T08:53:10Z DEBUG Verifying that ipatest1.int.test (realm None)
> is an IPA server
> 2022-05-03T08:53:10Z DEBUG Init LDAP connection to:
> ldap://ipatest1.int.test:389
> 2022-05-03T08:53:10Z DEBUG Search LDAP server for IPA base DN
> 2022-05-03T08:53:10Z DEBUG Check if naming context 'dc=test' is for IPA
> 2022-05-03T08:53:10Z DEBUG Naming context 'dc=test' is a valid IPA context
> 2022-05-03T08:53:10Z DEBUG Search for (objectClass=krbRealmContainer) in
> dc=test (sub)
> 2022-05-03T08:53:10Z DEBUG Found: cn=TEST,cn=kerberos,dc=test
> 2022-05-03T08:53:10Z DEBUG Skipping invalid realm 'TEST' (single label
> realms are not supported)
> 2022-05-03T08:53:10Z DEBUG Discovery result: NOT_IPA_SERVER; server=None,
> domain=test, kdc=ipatest1.int.test, bas
> edn=dc=test
> 2022-05-03T08:53:10Z DEBUG Validated servers:
> 2022-05-03T08:53:10Z DEBUG No IPA server found
> <-- snip
>
>
> Thanks
> Angus
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> Do not reply to spam on the list, report it:
> https://pagure.io/fedora-infrastructure
>
2 years, 1 month
How to determine if an IPA certificate is in use or not?
by Kathy Zhu
Hi Team,
We have an IPA certificate expiring very soon. I do not believe that is in
use, but I need to verify that. I checked in following two ways:
1, Via GUI, Identity, Services, searched for the host (which is our very
first IPA server), compared each cert against the serial number of the
expiring one.
2, Checked nssdb:
# certutil -L -d /etc/pki/nssdb
Certificate Nickname Trust
Attributes
SSL,S/MIME,JAR/XPI
#
Are there other ways to verify this?
Thank you.
Kathy.
2 years, 1 month
EL8 ipa upgrade / Single Level Domain
by Angus Clarke
Hello
We installed our IPA servers back in EL7.2 days and deployed with a single level domain and matching (uppercased) realm. Through various upgrades we are now at EL7.9 and are aware that the ipa-client-install command has become finickity about single level domains however thus far we have been able to continue joining EL7 clients.
I've setup my test environment similarly and have been unsuccessful in trying to upgrade (join new and replace old) these EL7 Freeipa servers to EL8, the ipa-client-install on EL8 skips the single level domain so I'm a bit stuck.
Is there a way around this in EL8?
EL7 ipa server (ipatest1):
ipa-server-4.6.8-5.0.1.el7_9.10.x86_64
EL8 (ipatest2):
ipa-server-4.9.6-12.0.1.module+el8.5.0+20642+b228f286.x86_64
[root@ipatest2 ~]# ipa-replica-install --setup-ca --ip-address 192.168.180.141 --password=Password1234 --principal=admin --setup-dns --forwarder=192.168.180.100
Configuring client side components
This program will set up IPA client.
Version 4.9.6
Unable to discover domain, not provided on command line
The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information
Removing client side components
IPA client is not configured on this system.
The ipa-client-install command failed.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
Configuration of client side components failed!
The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
[root@ipatest2 ~]# less /var/log/ipaclient-install.log
<-- snip
2022-05-03T08:53:10Z DEBUG [IPA Discovery]
2022-05-03T08:53:10Z DEBUG Starting IPA discovery with domain=None, servers=None, hostname=ipatest2.int.test
2022-05-03T08:53:10Z DEBUG Start searching for LDAP SRV record in "int.test" (domain of the hostname) and its sub-d
omains
2022-05-03T08:53:10Z DEBUG Search DNS for SRV record of _ldap._tcp.int.test
2022-05-03T08:53:10Z DEBUG DNS record not found: NXDOMAIN
2022-05-03T08:53:10Z DEBUG Search DNS for SRV record of _ldap._tcp.test
2022-05-03T08:53:10Z DEBUG DNS record found: 0 100 389 ipatest1.int.test.
2022-05-03T08:53:10Z DEBUG [Kerberos realm search]
2022-05-03T08:53:10Z DEBUG Search DNS for TXT record of _kerberos.test
2022-05-03T08:53:10Z DEBUG DNS record found: "TEST"
2022-05-03T08:53:10Z DEBUG Skipping invalid realm 'TEST' (single label realms are not supported)
2022-05-03T08:53:10Z DEBUG Search DNS for SRV record of _kerberos._udp.test
2022-05-03T08:53:10Z DEBUG DNS record found: 0 100 88 ipatest1.int.test.
2022-05-03T08:53:10Z DEBUG [LDAP server check]
2022-05-03T08:53:10Z DEBUG Verifying that ipatest1.int.test (realm None) is an IPA server
2022-05-03T08:53:10Z DEBUG Init LDAP connection to: ldap://ipatest1.int.test:389
2022-05-03T08:53:10Z DEBUG Search LDAP server for IPA base DN
2022-05-03T08:53:10Z DEBUG Check if naming context 'dc=test' is for IPA
2022-05-03T08:53:10Z DEBUG Naming context 'dc=test' is a valid IPA context
2022-05-03T08:53:10Z DEBUG Search for (objectClass=krbRealmContainer) in dc=test (sub)
2022-05-03T08:53:10Z DEBUG Found: cn=TEST,cn=kerberos,dc=test
2022-05-03T08:53:10Z DEBUG Skipping invalid realm 'TEST' (single label realms are not supported)
2022-05-03T08:53:10Z DEBUG Discovery result: NOT_IPA_SERVER; server=None, domain=test, kdc=ipatest1.int.test, bas
edn=dc=test
2022-05-03T08:53:10Z DEBUG Validated servers:
2022-05-03T08:53:10Z DEBUG No IPA server found
<-- snip
Thanks
Angus
2 years, 1 month
error: PAM: User account has expired for <user>
by Ben Aveling
We're having users unable to login on some hosts.
The error message in /var/log/secure is:
sshd[29399]: error: PAM: User account has expired for <<username>> from <<ip address>>
The same users can login fine to other hosts, suggesting it's a config or other issue with these specific hosts.
Has anyone seen anything similar?
2 years, 1 month
