FreeIPA - Set dnarange and change CA Renewal Master

I've written about how to set up a FreeIPA instance and replica for managing your sudo-rules, hbac-rules, users, groups and DNS Zones. Since hardware (and I recommend using mostly hardware for your deployment) ages, you'll have to replace them once in a while and sometimes the replica join might not go as smooth as expected. I'll cover how to fix two problems that occurred to me after I decommissioned my original master Server.

First problem, dnarange was not set on the new replica after decommissioning the original master

The dnarange is basically your user- and group-id range. If there's no range there and you're trying to create a user, your command will fail with an error saying that there's no dnarange available. In order to fix this, run the following commands:

Get the user-id of your admin user which always uses the first available uid in the dnarange when being installed:

 [archy@ipa03 ~]$ ipa user-show admin | egrep -i 'uid|gid'  
  UID: 10000  
  GID: 10000

So now we know that the first ID is '10000' and usually the installer allocated around 20.000 IDs of range. That means our max ID will be '30000-1' so the last usable ID is 29999. With that knowledge, you can set the dnarange on the replica:

 [archy@ipa03 ~]$ ipa-replica-manage dnarange-set ipa03.archyslife.lan 10000-29999

Verify your changes:

 [archy@ipa03 ~]$ ipa-replica-manage dnarange-show  
  ipa02.archyslife.lan: 10000-29999  
  ipa03.archyslife.lan: 10000-29999

Users can not be created again on the new replica.

Next problem I encountered, was the ca renewal master not being set correctly after a replica has been added. This only applies if the ca-role is not assigned to every node in the cluster.

 [archy@ipa03 ~]$ ipa-csreplica-manage list  
  ipa02.archyslife.lan:   
  ipa03.archyslife.lan:

So these are my 2 Nodes that have the ca-role enabled but none of them is the master. Without a valid master, no certificates can be renewed and your services will crash if it goes undetected for too long.

To fix this, run the set-renewal-master command on the new master:

 [archy@ipa03 ~]$ ipa-csreplica-manage set-renewal-master ipa03.archyslife.lan

Verify the changes you've made:

 [archy@ipa03 ~]$ ipa-csreplica-manage list  
  ipa02.archyslife.lan:   
  ipa03.archyslife.lan: master

The new ca renewal master appears to be assigned. You should still monitor your certificates if they are renewed correctly or if there appear to be errors. In my experience, you should be good to go and not expect any problems down the line if everything completed without errors so far.

Feel free to comment and / or suggest any topics.

Comments

Dynamic DNS with BIND and ISC-DHCP

I personally prefer to work with hostnames instead of ip-addresses. If you have anything like freeipa or active directory, it will do that for you by registering the client you added to your realm to the managed dns and edit the records dynamically. We can achieve the same goal with just bind and isc-dhcp. I'll use a raspberry pi with raspbian 9 for this setup. So here is a quick tutorial on how to configure the isc-dhcp-server to dynamically update bind. First set a static ip to your server. [archy@ddns ~]$ sudo vim /etc/network/interfaces # interfaces(5) file used by ifup(8) and ifdown(8) # Please note that this file is written to be used with dhcpcd # For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf' # Include files from /etc/network/interfaces.d: source-directory /etc/network/interfaces.d auto eth0 iface eth0 inet static address 172.31.30.5 network 172.31.30.0 broadcast 172.31.30.255 netmask 255.255.255.0 ...

LACP-Teaming on CentOS 7 / RHEL 7

What is teaming? Teaming or LACP (802.3ad) is a technique used to bond together multiple interfaces to achieve higher combined bandwith. NOTE: every clients speed can only be as high as the single link speed of one of the members. That means, if the interfaces I use in the bond have 1 Gigabit, every client will only have a maximum speed of 1 Gigabit. The advantage of teaming is, that it can handle multiple connections with 1 Gigabit. How many connections depends on the amount of your network cards. I'm using 2 network cards for this team on my server. That means I can handle 2 Gigabit connections at full rate on my server provided the rest of the hardware can deliver that speed. There also exists 'Bonding' in the Linux world. They both do the same in theory but for a detailed comparison check out this article about teaming in RHEL7 . To create a teaming-interface, we will first have to remove all the interface configurations we've done on the (soon to be) sla...

Push logs and data into elasticsearch - Part 2 Mikrotik Logs

This is only about the setup of different logging, one being done with Filebeat and the other being done with sending logging to a dedicated port opened in Logstash using the TCP / UDP Inputs. Prerequesites: You'll need a working Elasticsearch Cluster with Logstash and Kibana. Start by getting the Log Data you want to structure parsed correctly. Mikrotik Logs are a bit difficult since they show you Data in the interface which is already enriched with Time / Date. That means a message that the remote logging will send to Logstash will look like this: firewall,info forward: in:lan out:wan, src-mac aa:bb:cc:dd:ee:ff, proto UDP, 172.31.100.154:57061->109.164.113.231:443, len 76 You can check them in the grok debugger and create your own filters and mapping. The following is my example which might not fit your needs. Here are some custom patterns I wrote for my pattern matching: MIKROTIK_DATE \b(?:jan(?:uary)?|feb(?:ruary)?|mar(?:ch)?|apr(?:il)?|may|jun(?:e)?|jul(?...

FreeIPA - Integrating your DHCPD dynamic Updates into IPA

I recently went over my network configuration and noticed that the dhcp-leases were not pushed into the IPA-DNS yet. So I thought, why not do it now. The setup is very similar to setting it up on a single bind instance not managed by IPA (I've already written a guide about this here ). My setup is done with the following hosts: ipa01.archyslife.lan - 172.31.0.1 inf01.archyslife.lan - 172.31.0.5 First of all, create a rndc-key: [archy@ipa01 ~]$ sudo rndc-confgen -a -b 512 This will create the following file '/etc/rndc-key' [archy@ipa01 ~]$ sudo cat /etc/rndc.key key "rndc-key" { algorithm hmac-md5; secret "secret_key_here=="; }; We also need to make named aware of the rndc-key and allow our remote dhcp server to write dns entries: [archy@ipa01 ~]$ sudo vim /etc/named.conf ... include "/etc/rndc-key"; controls { inet 172.31.0.1 port 953 allow { 172.31.0.5; } keys ...

SSSD - Debugging PAM permission denied

Sometimes there's weird errors in IT that occur on random chance. I've had such an encounter with SSSD in combination with IPA(+AD-Trust) recently, where only sometimes, a connection to one of the IPA-Servers would fail with this error: Jul 13 13:36:42 ipa02.archyslife.lan sshd[3478]: pam_sss(sshd:account): Access denied for user runner: 4 (System error) Jul 13 13:36:42 ipa02.archyslife.lan sshd[3478]: fatal: Access denied for user runner by PAM account configuration [preauth] In my case, it was only happening sometimes when running a basic system setup role using ansible on every host in the entire environment. This way, there was no consistent pattern besides being the same host every time if it failed. First up, add the 'debug_level=X' to every section required in the /etc/sssd/sssd.conf where X is a number from 1 to 10 with 10 being the most verbose. Afterward, restart sssd and check the logs for any obvious problems. 1) If you are using local users, check the...

Archy's Blog

Search This Blog