[Freeipa-users] Adjusting nsslapd-cachememsize

2017-03-16 Thread Lachlan Musicman 
While going through the logs on the FreeIPA server, I noticed this:


WARNING: changelog: entry cache size 2097152 B is less than db size
12804096 B; We recommend to increase the entry cache size
nsslapd-cachememsize.


I have found a number of documents:

What it is:
https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/8.0/html/Configuration_and_Command_Reference/Configuration_Command_File_Reference-Database_Attributes_under_cnNetscapeRoot_cnldbm_database_cnplugins_cnconfig_and_cnUserRoot_cnldbm_database_cnplugins_cnconfig-nsslapd_cachememsize.html

How to tune it:
https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/8.1/html/Administration_Guide/memoryusage.html


etc etc.

I have no idea of what the secret password is for the "cn=directory
manager" and can't find any information about where I might find it or
where or when it might have been set anywhere. I have found a number of
likely candidates, but none have worked.

I found this page:

https://www.freeipa.org/page/Howto/Change_Directory_Manager_Password

but I'd prefer to not change the password if possible.

cheers
L.



--
The most dangerous phrase in the language is, "We've always done it this
way."

- Grace Hopper
-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] HBAC not working, freeipa 4.4, sssd 1.15.1

2017-03-16 Thread Lachlan Musicman 
Which logs do you want from the server?

--
The most dangerous phrase in the language is, "We've always done it this
way."

- Grace Hopper

On 16 March 2017 at 20:09, Jakub Hrozek  wrote:

> On Thu, Mar 16, 2017 at 07:56:58PM +1100, Lachlan Musicman wrote:
> > Yes. What I do would you like? Current debug levels are at 8
>
> Logs and id output from the server and the client at the same time..
>
-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

[Freeipa-users] Slow logins on one ipa client- due to SSS_PAM_ACCT_MGMT

2017-03-16 Thread Kilborn, Jim 
Greetings,

My first post to the forum.

We are running centos7 with freeipa. Syncing from AD, with one linux replica.
The ipa clients are getting installed by puppet. All the clients are performing 
fine, except one. I am getting slow ssh logins to one host, as well as slow 
'id' and 'who', etc.

I turned up the sss-debuglevel to 6, and compared the slow client to another, 
and I am seeing a section in the logs that is unique to the slow system, 
basically its doing a SSS_PAM_ACCT_MGMT, and I don't have any clue why. Same 
user logging in to both clients, one client does the SSS_PAM_ACCT_MGMT, 
followed by the SSS_PAM_OPEN_SESSION. While the other client only does 
SSS_PAM_OPEN_SESSION, and is much faster. (1 second vs 2-8 seconds)
It seems the SSS_PAM_ACCT_MGMT is the slow culprit, and I don't know why its 
running.

Any idea what would cause this or where I should look?

Below are the log for a good fast client, followed by the log from the slow 
client.

Thanks!!

Good Client
[dp_get_account_info_handler] (0x0200): Got request for 
[0x3][BE_REQ_INITGROUPS][1][name=nob...@ipa.mydomain.org]
[sysdb_get_real_name] (0x0040): Cannot find user [nob...@ipa.mydomain.org] in 
cache
[ipa_id_get_account_info_orig_done] (0x0080): Object not found, ending request
[dp_get_account_info_handler] (0x0200): Got request for 
[0x1][BE_REQ_USER][1][name=myusern...@ipa.mydomain.org]
[sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such 
object](32)[ldb_wait: No such object (32)]
[sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for 
name=myusern...@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb
[dp_get_account_info_handler] (0x0200): Got request for 
[0x1][BE_REQ_USER][1][name=myusern...@ipa.mydomain.org]
[sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such 
object](32)[ldb_wait: No such object (32)]
[sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for 
name=myusern...@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb
[dp_get_account_info_handler] (0x0200): Got request for 
[0x3][BE_REQ_INITGROUPS][1][name=myusern...@ipa.mydomain.org]
[sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such 
object](32)[ldb_wait: No such object (32)]
[sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for 
name=myusern...@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb
[sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such 
object](32)[ldb_wait: No such object (32)]
[sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for 
name=myusern...@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb
[dp_pam_handler] (0x0100): Got request with the following data
[pam_print_data] (0x0100): command: SSS_PAM_OPEN_SESSION
[pam_print_data] (0x0100): domain: ipa.mydomain.org
[pam_print_data] (0x0100): user: myusern...@ipa.mydomain.org
[pam_print_data] (0x0100): service: sshd
[pam_print_data] (0x0100): tty: ssh
[pam_print_data] (0x0100): ruser:
[pam_print_data] (0x0100): rhost: myhost.mydomain.org
[pam_print_data] (0x0100): authtok type: 0
[pam_print_data] (0x0100): newauthtok type: 0
[pam_print_data] (0x0100): priv: 1
[pam_print_data] (0x0100): cli_pid: 26697
[pam_print_data] (0x0100): logon name: not set


Bad Client
[dp_get_account_info_handler] (0x0200): Got request for 
[0x3][BE_REQ_INITGROUPS][1][name=nob...@ipa.mydomain.org]
[sysdb_get_real_name] (0x0040): Cannot find user [nob...@ipa.mydomain.org] in 
cache
[ipa_id_get_account_info_orig_done] (0x0080): Object not found, ending request
[dp_get_account_info_handler] (0x0200): Got request for 
[0x1][BE_REQ_USER][1][name=myusern...@ipa.mydomain.org]
[sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such 
object](32)[ldb_wait: No such object (32)]
[sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for 
name=myusern...@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb
[dp_get_account_info_handler] (0x0200): Got request for 
[0x1][BE_REQ_USER][1][name=myusern...@ipa.mydomain.org]
[sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such 
object](32)[ldb_wait: No such object (32)]
[sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for 
name=myusern...@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb
[dp_get_account_info_handler] (0x0200): Got request for 
[0x3][BE_REQ_INITGROUPS][1][name=myusern...@ipa.mydomain.org]
[sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such 
object](32)[ldb_wait: No such object (32)]
[sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for 
name=myusern...@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb
[sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such 
object](32)[ldb_wait: No such object (32)]
[sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for 
name=myusern...@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb
[dp_pam_handler] (0x0100): Got request with the following data
[pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT
[pam_print_data] (0x0100): domain: ipa.mydomain.org
[pam_print_data] (0x0100): user:

[Freeipa-users] Manual Cleanup

2017-03-16 Thread Ian Harding 
I've made some progress.  But I have one zombie replication agreement to
kill, I just don't know the syntax.

freeipa-dal.bpt.rocks does not exist.  I want all references to it to go
away.

How would I do that with ldapmodify?

Thanks!


[root@freeipa-sea slapd-BPT-ROCKS]# ldapsearch  -D "cn=directory
manager" -w ... -b "o=ipaca"
"(&(objectclass=nstombstone)(nsUniqueId=---))"
nscpentrywsi
# extended LDIF
#
# LDAPv3
# base

Re: [Freeipa-users] replica install seems to hang forever when "--setup-ca" is enabled - any advice?

2017-03-16 Thread Chris Dagdigian 


That looks exactly like my issue, thanks! Will monitor that ticket. Much 
appreciated.


Martin Basti wrote:


Could it be this?
https://pagure.io/freeipa/issue/6766



--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] HBAC not working, freeipa 4.4, sssd 1.15.1

2017-03-16 Thread Jakub Hrozek 
On Thu, Mar 16, 2017 at 07:56:58PM +1100, Lachlan Musicman wrote:
> Yes. What I do would you like? Current debug levels are at 8

Logs and id output from the server and the client at the same time..

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] HBAC not working, freeipa 4.4, sssd 1.15.1

2017-03-16 Thread Lachlan Musicman 
Yes. What I do would you like? Current debug levels are at 8

L.

On 16 Mar. 2017 7:06 pm, "Jakub Hrozek"  wrote:

> On Thu, Mar 16, 2017 at 11:36:57AM +1100, Lachlan Musicman wrote:
> > I'm experiencing issues with HBAC and I think it's a bug in sssd. Not
> sure
> > if better to report to here or sssd mailing list. Also sssd in pagure is
> > bare and I didn't want to sully the blank slate.  (
> > https://pagure.io/sssd/issues )
> >
> > The details:
> >
> > env: CentOS 7.3, FreeIPA 4.4, sssd 1.15.1 from COPR
> >
> > On the IPA server:
> >
> > - "ipa hbactest ..." returns TRUE, so everything seems set up correctly.
> >
> >
> > When I try to login to the test client, I get denied.
> >
> > On the test client:
> >
> >  - hbac_eval_user_element is returning a wrong value. This is seen in
> > sssd_domain.log, it's returning 25. My test user is in 37 groups. This is
> > seen on the IPA server via id username. On the test client id username
> > returns 36 groups, the one missing is an IPA (not AD) group that was made
> > for HBAC rules. I have sanitized logs available.
> >
> >  -  taking ldbsearch -H /var/lib/sss/db/cache_domain.com.ldb
> > '(objectclass=user)' and finding the record in question shows the same 36
> > groups available. The missing group shouldn't affect ability to login via
> > HBAC
> >
> >  - getent group (groupname) works as expected. Also worth noting that the
> > group missing from id username shows that user in getent.
> >
> > For reference, on the client the sssd service was stopped, the cache
> > deleted, and the service started again the night before after which the
> > server wasn't accessed by anyone. I find that this is necessary for the
> > cache to populate.
> >
> > Should I put in a bug report against SSSD or FreeIPA?
> >
> > While HBAC is in FreeIPA, I think that this is an issue in SSSD
> > (specifically ?
>
> Yes, SSSD.
>
> I remember you had some intermittent issues in the past, is this one
> reproducable?
>
> --
> Manage your subscription for the Freeipa-users mailing list:
> https://www.redhat.com/mailman/listinfo/freeipa-users
> Go to http://freeipa.org for more info on the project
>
-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] replica install seems to hang forever when "--setup-ca" is enabled - any advice?

2017-03-16 Thread Martin Basti 


On 16.03.2017 01:34, Fraser Tweedale wrote:
> On Wed, Mar 15, 2017 at 06:32:42PM -0400, Chris Dagdigian wrote:
>> Any tips for diving into this a bit more to troubleshoot?
>>
>> For the 1st time I'm setting up an ipa-server 4.4 replica with CA features
>> enabled but the replica install seems to hang forever here:
>>
>> ...
>> ...
>> ...
>> Done configuring directory server (dirsrv).
>> Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30
>> seconds
>>   [1/27]: creating certificate server user
>>   [2/27]: configuring certificate server instance
>>   [3/27]: stopping certificate server instance to update CS.cfg
>>   [4/27]: backing up CS.cfg
>>   [5/27]: disabling nonces
>>   [6/27]: set up CRL publishing
>>   [7/27]: enable PKIX certificate path discovery and validation
>>   [8/27]: starting certificate server instance
>>
>> < no output after this >
>>
>>
>> The replica-install.log file ends here:
>>
>> ...
>> ...
>> ...
>> 2017-03-15T22:16:05Z DEBUG Starting external process
>> 2017-03-15T22:16:05Z DEBUG args=/bin/systemctl is-active
>> pki-tomcatd@pki-tomcat.service
>> 2017-03-15T22:16:05Z DEBUG Process finished, return code=0
>> 2017-03-15T22:16:05Z DEBUG stdout=active
>>
>> 2017-03-15T22:16:05Z DEBUG stderr=
>> 2017-03-15T22:16:05Z DEBUG wait_for_open_ports: localhost [8080, 8443]
>> timeout 300
>> 2017-03-15T22:16:06Z DEBUG Waiting until the CA is running
>> 2017-03-15T22:16:06Z DEBUG request POST
>> http://deawilidmp001.XXX.org:8080/ca/admin/ca/getStatus
>> 2017-03-15T22:16:06Z DEBUG request body ''
>>
>>
>>
>>
>> I've confirmed that SELINUX is disabled, there is no firewall and the AWS
>> Security Groups are allowing TCP:8080 and TCP:8443 to the replica instance.
>> The systemctl command also verifies that
>> pki-tomcatd@pki-tomcat.service is "active" as well.
>>
>>
>> Any tips for debugging further?
>>
> Could you please provide the /var/log/pki/pki-tomcat/ca/debug log
> file?
>
> Thanks,
> Fraser
>

Could it be this?
https://pagure.io/freeipa/issue/6766



signature.asc
Description: OpenPGP digital signature
-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] HBAC not working, freeipa 4.4, sssd 1.15.1

2017-03-16 Thread Jakub Hrozek 
On Thu, Mar 16, 2017 at 11:36:57AM +1100, Lachlan Musicman wrote:
> I'm experiencing issues with HBAC and I think it's a bug in sssd. Not sure
> if better to report to here or sssd mailing list. Also sssd in pagure is
> bare and I didn't want to sully the blank slate.  (
> https://pagure.io/sssd/issues )
> 
> The details:
> 
> env: CentOS 7.3, FreeIPA 4.4, sssd 1.15.1 from COPR
> 
> On the IPA server:
> 
> - "ipa hbactest ..." returns TRUE, so everything seems set up correctly.
> 
> 
> When I try to login to the test client, I get denied.
> 
> On the test client:
> 
>  - hbac_eval_user_element is returning a wrong value. This is seen in
> sssd_domain.log, it's returning 25. My test user is in 37 groups. This is
> seen on the IPA server via id username. On the test client id username
> returns 36 groups, the one missing is an IPA (not AD) group that was made
> for HBAC rules. I have sanitized logs available.
> 
>  -  taking ldbsearch -H /var/lib/sss/db/cache_domain.com.ldb
> '(objectclass=user)' and finding the record in question shows the same 36
> groups available. The missing group shouldn't affect ability to login via
> HBAC
> 
>  - getent group (groupname) works as expected. Also worth noting that the
> group missing from id username shows that user in getent.
> 
> For reference, on the client the sssd service was stopped, the cache
> deleted, and the service started again the night before after which the
> server wasn't accessed by anyone. I find that this is necessary for the
> cache to populate.
> 
> Should I put in a bug report against SSSD or FreeIPA?
> 
> While HBAC is in FreeIPA, I think that this is an issue in SSSD
> (specifically ?

Yes, SSSD.

I remember you had some intermittent issues in the past, is this one
reproducable?

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project