September 2023 - FreeIPA-users - Fedora Mailing-Lists

by Jay Smith

For a test setup I try to get running a FreeIPA server within a docker container(DinD). But I get some errors and I don't know why. 1. Create docker in docker container => docker run --privileged -itd --name docker_swarm -v /sys/fs/cgroup:/sys/fs/cgroup docker 2. Connect to docker container and run the FreeIPA server => docker exec -it docker_swarm \ sh -c "docker run --sysctl net.ipv6.conf.all.disable_ipv6=0 --privileged=true --name ipa -ti -h ipa.example.test --cgroupns=host \ -v /sys/fs/cgroup:/sys/fs/cgroup:rw -v /tmp/freeipa-data:/data freeipa/freeipa-server:fedora-38-4.10.2 --skip-mem-check --no-ntp" The error I get is: docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: unable to apply cgroup configuration: failed to write 670: write /sys/fs/cgroup/docker/3c2cc48a075d3f62143d70718aefe4c55938e4332262894e67f31328eaa5a006/cgroup.procs: no such file or directory: unknown. ERRO[0038] error waiting for container: The command is working outside of Docker in Docker. Maybe it is possible to deactivated all the cgroups stuff? I don't need all features of FreeIPA just certificates, authentication(LDAP), DNS, ...

7 months, 3 weeks

4
4
2 / 0

Migration of DNS Zones and it's records from one FreeIPA server to other

by Srikanth C

Hi, I am looking for the process to migrate the DNS Zones and it's records from one FreeIPA to other FreeIPA server. I have gone through the documentation but didn't find any automated way for this. Any idea how can we migrate? Thanks.

7 months, 3 weeks

2
1
0 / 0

Managing FreeIPA installations without Trusts between them

by dweller dweller

We have a requirement to segregate different types of users, including customers, administrators, clients, and infrastructure hosts, into separate realms or unique IPA installations. While this is potentially feasible through the Trust feature, considering its ongoing development state, we're looking for alternative solutions. (see pic https://imgur.com/a/uqtbjly) Our objectives are: 1) Admin users within the ADMIN.NOVALOCAL realm should secure sudo access to hosts within the realms of CUSTOMER1.NOVALOCAL and CUSTOMER2.NOVALOCAL. 2) Admin users should also possess the capability to manage IPA entities within both customer installations of FreeIPA. We possess a rudimentary understanding of how to tackle the second objective. However, for the first one, our strategy is less clear. One available method is to instantiate hosts with a custom PAM configuration and administer access to administrators via the pam_ldap module. But we are also open to better suggestions if anyone can put forward.

7 months, 3 weeks

2
3
0 / 0

FreeIPA PKI Certs wont renew "Adjustment limit exceeded"

by T A

On FreeIPA version 4.6.8-5 realized that pki-tomcatd wouldnt start ipactl status pki-tomcatd Service: STOPPED Ran 'getcert list' and found the 'pki-tomcat' cert was expired Rolled back the system clock to before the cert expired, now starts up ipactl status pki-tomcatd Service: STARTED Tried to renew with 'ipa-getcert resubmit -i "123456"' but it shows "status: CA_UNREACHABLE" 'ipa-cert fix' didnt work either Checked logs again 'journalctl -t certmonger' and found 'ns-slapd' was giving out this error when it tried to renew 'csngen_adjust_local_time - Adjustment limit exceeded: value - 435060 limit - 86400' Any way to change the adjustment limit or force this cert to renew anyway?

7 months, 4 weeks

3
6
3 / 0

FreeIPA not starting

by Francis Augusto Medeiros-Logeay

Hi, I have a FreeIPA on a VM that I use for testing. I had to take a pause on my work with it, and after a few months, when I turn on the machine, FreeIPA won’t start. I get this error: [Fri Sep 22 18:31:03.162384 2023] [wsgi:error] [pid 2433:tid 2433] ModuleNotFoundError: No module named 'ipaserver.plugins.' [Fri Sep 22 18:31:03.183566 2023] [wsgi:error] [pid 2434:tid 2434] ipa: ERROR: Failed to start IPA: No module named 'ipaserver.plugins.' [Fri Sep 22 18:31:03.183611 2023] [wsgi:error] [pid 2434:tid 2434] mod_wsgi (pid=2434): Failed to exec Python script file '/usr/share/ipa/wsgi.py'. [Fri Sep 22 18:31:03.183634 2023] [wsgi:error] [pid 2434:tid 2434] mod_wsgi (pid=2434): Exception occurred processing WSGI script '/usr/share/ipa/wsgi.py'. [Fri Sep 22 18:31:03.184501 2023] [wsgi:error] [pid 2434:tid 2434] Traceback (most recent call last): [Fri Sep 22 18:31:03.184797 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/share/ipa/wsgi.py", line 28, in <module> [Fri Sep 22 18:31:03.184805 2023] [wsgi:error] [pid 2434:tid 2434] application = create_application() [Fri Sep 22 18:31:03.184810 2023] [wsgi:error] [pid 2434:tid 2434] ^^^^^^^^^^^^^^^^^^^^ [Fri Sep 22 18:31:03.184819 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipaserver/wsgi.py", line 51, in create_application [Fri Sep 22 18:31:03.184824 2023] [wsgi:error] [pid 2434:tid 2434] api.finalize() [Fri Sep 22 18:31:03.184831 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipalib/plugable.py", line 753, in finalize [Fri Sep 22 18:31:03.184836 2023] [wsgi:error] [pid 2434:tid 2434] self.__do_if_not_done('load_plugins') [Fri Sep 22 18:31:03.184844 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipalib/plugable.py", line 432, in __do_if_not_done [Fri Sep 22 18:31:03.184849 2023] [wsgi:error] [pid 2434:tid 2434] getattr(self, name)() [Fri Sep 22 18:31:03.184856 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipalib/plugable.py", line 633, in load_plugins [Fri Sep 22 18:31:03.184860 2023] [wsgi:error] [pid 2434:tid 2434] self.add_package(package) [Fri Sep 22 18:31:03.184867 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipalib/plugable.py", line 660, in add_package [Fri Sep 22 18:31:03.184872 2023] [wsgi:error] [pid 2434:tid 2434] module = importlib.import_module(name) [Fri Sep 22 18:31:03.184876 2023] [wsgi:error] [pid 2434:tid 2434] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [Fri Sep 22 18:31:03.184890 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib64/python3.11/importlib/__init__.py", line 126, in import_module [Fri Sep 22 18:31:03.184894 2023] [wsgi:error] [pid 2434:tid 2434] return _bootstrap._gcd_import(name[level:], package, level) [Fri Sep 22 18:31:03.184898 2023] [wsgi:error] [pid 2434:tid 2434] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [Fri Sep 22 18:31:03.184905 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1204, in _gcd_import [Fri Sep 22 18:31:03.184912 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1176, in _find_and_load [Fri Sep 22 18:31:03.184918 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1126, in _find_and_load_unlocked [Fri Sep 22 18:31:03.184925 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed [Fri Sep 22 18:31:03.184931 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1204, in _gcd_import [Fri Sep 22 18:31:03.184942 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1176, in _find_and_load [Fri Sep 22 18:31:03.184948 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1140, in _find_and_load_unlocked [Fri Sep 22 18:31:03.184964 2023] [wsgi:error] [pid 2434:tid 2434] ModuleNotFoundError: No module named 'ipaserver.plugins.’ This is weird, can you help me to get it back to a usable state? Best, Francis

7 months, 4 weeks

2
2
0 / 0

Has anyone tried FreeIPA with RSA's SecurID® Authentication Agent for PAM ?

by White, Daniel E. (GSFC-770.0)[AEGIS]

Has anyone tried FreeIPA with RSA's SecurID® Authentication Agent for PAM ? https://community.rsa.com/t5/securid-authentication-agent-for/tkb-p/auth-...

7 months, 4 weeks

1
0
0 / 0

Lost password for CA private key

by John Stokes

I have an IPA CA that is running fine for several years now. I also have two replicas installed. Today while creating a backup I realized I don't know the password for the file /root/cacert.p12 where the private key of the CA should be stored. The one I thought it should be (same as the pass for my admin user) does not seem to be working. Is there a way to reexport the private key of the CA? As I said everything is working fine and I have access to the server. If not how should I proceed? Should I destroy the whole CA and build a new one?

7 months, 4 weeks

3
8
1 / 0

prevent 'sudo -i ' from executing

by Nathanaël Blanchet

Hello, I don't want my users to become root with simply executing the 'sudo -i' command so they can execute all root commands. Users should only execute with sudo the allowed defined commands. I'm able to prevent them from executing 'sudo su -', but I didn't find any informations about forbidding 'sudo -i'. Thank you for your help. -- Nathanaël Blanchet Administrateur Systèmes et Réseaux Service Informatique et REseau (SIRE) Département des systèmes d'information 227 avenue Professeur-Jean-Louis-Viala 34193 MONTPELLIER CEDEX 5 Tél. 33 (0)4 67 54 84 55 Fax 33 (0)4 67 54 84 14 blanchet(a)abes.fr

8 months

5
7
0 / 0

RedHat and 2FA Problem

by Sirio Sannipoli

Hello everyone, I've already done searches without success, I need someone to point me in the direction of resolving a strange behavior I'm experiencing on servers with the RedHat/Centos operating system. I have installed FreeIPA 4.10.1 on Oracle Linux 9 and all users by default have Radius authentication via a Cisco server, users can access via SSH to 100 Servers configured, we have OS of all types (Debian, RedHat, Centos, Ubuntu). The behavior I get is the following: Debian based distro: SSH Login and SUDO work perfectly using the Radius credentials RedHat based distro: SSH Login prompt ask for 2FA, first factor & second factor (optional) and i can login by entering the Radius credentials and using the same password 2 times, SUDO ask for 2FA and authentication fails when entering the same password 2 times. I don't understand if the problem is on the FreeIPA client or server or why there is a difference in behavior between Debian and RedHat systems. Can anyone give me directions to understand what's happening? Note: I have never set up 2FA authentication on the FreeIPA server, the users are correctly configured and the "ipa user-show" command confirms "User authentication types: radius", if i change user configuration with the password, everything works fine.

8 months

4
4
0 / 0

External bind with certs with sysaccounts

by Tania Hagan

Hi Freeipa-users, Is is possible to create a binddn account in cn=sysaccounts and attach certs to the account so it can be used in scripts to bind using external bind with certs? I know how to create my sysaccount and I found https://www.freeipa.org/page/V4/User_Certificates which provides instructions on attaching certificates to user accounts but not sure how this references to attaching certs to sysaccounts. Many Thanks, Tania

8 months

2
3
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2023