FreeIPA installation bzw. der Versuch davon

igami · 16. Mai 2020 um 11:37

Neues Wochenende neues Spiel

heute richte ich mich nach der Anleitung von Computing for Geeks

https://vmbs.uk/t/how-to-install-freeipa-server-lets-encrypt-on-centos-7/69

VM wird wie gehabt eingerichtet, nur diesmal ein CentOS 8 anstelle eines CentOS 7, 2 vCPUs und 4 gb RAM
yum -y upgrade
Hostname setzen

hostnamectl set-hostname ipa.makerspace-gt.de
echo "192.251.226.18 ipa.makerspace-gt.de ipa" | sudo tee -a /etc/hosts

timedatectl set-timeone Europe/Berlin
I had failed installation with SELinux in enforcing mode, I recommend you set it to permissive or disabled.
- setenforce 0
- sed -i 's/^SELINUX=.*/SELINUX=permissive/g' /etc/selinux/config
Since this is FreeIPA Server installation, install DL1 stream and then freeipa-server.
- yum -y install @idm:DL1
- yum -y install freeipa-server

Dann ist soweit alles vorbereitet und der Server wird konfiguriert

ipa-server-install

The ipa-client-install command was successful

Please add records in this file to your DNS system: /tmp/ipa.system.records.fr5e7ngf.db
==============================================================================
Setup complete

Next steps:
  1. You must make sure these network ports are open:
    TCP Ports:
      * 80, 443: HTTP/HTTPS
      * 389, 636: LDAP/LDAPS
      * 88, 464: kerberos
    UDP Ports:
      * 88, 464: kerberos
      * 123: ntp

  2. You can now obtain a kerberos ticket using the command: 'kinit admin'
    This ticket will allow you to use the IPA tools (e.g., ipa user-add)
    and the web user interface.

Be sure to back up the CA certificates stored in /root/cacert.p12
These files are required to create replicas. The password for these
files is the Directory Manager password
The ipa-server-install command was successful

ich bekomme in Firefox immer noch die Warnung

Fehler: Gesicherte Verbindung fehlgeschlagen

Beim Verbinden mit ipa.makerspace-gt.de trat ein Fehler auf. Sie haben ein ungültiges Zertifikat erhalten. Bitte kontaktieren Sie den Server-Administrator oder E-Mail-Korrespondenten und geben Sie diesen die folgenden Informationen: Ihr Zertifikat enthält die gleiche Seriennummer wie ein anderes Zertifikat dieser Zertifizierungsstelle. Bitte erwerben Sie ein neues Zertifikat mit einer eindeutigen Seriennummer. Fehlercode:
SEC_ERROR_REUSED_ISSUER_AND_SERIAL

Die Website kann nicht angezeigt werden, da die Authentizität der erhaltenen Daten nicht verifiziert werden konnte.
Kontaktieren Sie bitte den Inhaber der Website, um ihn über dieses Problem zu informieren.

Ich versuche mich noch einmal an der Installtion von letsencrypt
- GitHub - freeipa/freeipa-letsencrypt: A quick hack allowing to use Let's Encrypt certificates for FreeIPA web interface. · GitHub
yum -y install git
yum config-manager --set-enabled PowerTools
cp -r /etc/httpd/alias /etc/httpd/alias_backup
git clone https://github.com/freeipa/freeipa-letsencrypt.git
cd freeipa-letsencrypt/

vi renew-le.sh

#!/usr/bin/bash
set -o nounset -o errexit

WORKDIR=$(dirname "$(realpath $0)")
EMAIL="info@makerspace-gt.de"

### cron
# check that the cert will last at least 2 days from now to prevent too frequent renewal
# comment out this line for the first run
if [ "${1:-renew}" != "--first-time" ]
then
        start_timestamp=`date +%s --date="$(openssl x509 -startdate -noout -in /var/lib/ipa/certs/httpd.crt | cut -d= -f2)"`
        now_timestamp=`date +%s`
        let diff=($now_timestamp-$start_timestamp)/86400
        if [ "$diff" -lt "2" ]; then
                exit 0
        fi
fi
cd "$WORKDIR"
# cert renewal is needed if we reached this line

# cleanup
rm -f "$WORKDIR"/*.pem
rm -f "$WORKDIR"/httpd-csr.*

# generate CSR
openssl req -new -sha256 -config "$WORKDIR/ipa-httpd.cnf"  -key /var/lib/ipa/private/httpd.key -out "$WORKDIR/httpd-csr.der"

# httpd process prevents letsencrypt from working, stop it
service httpd stop

# get a new cert
letsencrypt certonly --standalone --csr "$WORKDIR/httpd-csr.der" --email "$EMAIL" --agree-tos

# replace the cert
cp /var/lib/ipa/certs/httpd.crt /var/lib/ipa/certs/httpd.crt.bkp
mv -f "$WORKDIR/0000_cert.pem" /var/lib/ipa/certs/httpd.crt
restorecon -v /var/lib/ipa/certs/httpd.crt

# start httpd with the new cert
service httpd start

vi ipa-httpd.cnf

# the fully qualified server (or service) name
FQDN = ipa.makerspace-gt.de
ALTNAMES = DNS:$FQDN

# --- no modifications required below ---
[ req ]
default_bits = 2048
default_md = sha256
prompt = no
encrypt_key = no
distinguished_name = dn
req_extensions = req_ext

[ dn ]
CN = $FQDN

[ req_ext ]
subjectAltName = $ALTNAMES

bash -x setup-le.sh

Auf einmal soll ich ein Passwort eingeben

+ openssl req -new -sha256 -config /root/freeipa-letsencrypt/ipa-httpd.cnf -key /var/lib/ipa/private/httpd.key -out /root/freeipa-letsencrypt/httpd-csr.der
Enter pass phrase for /var/lib/ipa/private/httpd.key:

Der Fehler ist bekannt! Und zum Glück auch ein Workaround
- First run - "Enter pass phrase for /var/lib/ipa/private/httpd.key" ? · Issue #18 · freeipa/freeipa-letsencrypt · GitHub
- bash -x /usr/libexec/ipa/ipa-httpd-pwdreader $HOSTNAME:443 RSA

Danach läuft das Scipt weiter nur um dann mit einem anderen Fehler abzubrechen

+ letsencrypt certonly --standalone --csr /root/freeipa-letsencrypt/httpd-csr.der --email info@makerspace-gt.de --agree-tos
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Performing the following challenges:
http-01 challenge for ipa.makerspace-gt.de
Waiting for verification...
Cleaning up challenges
An unexpected error occurred:
Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 384, in _make_request
    six.raise_from(e, None)
  File "<string>", line 3, in raise_from
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 380, in _make_request
    httplib_response = conn.getresponse()
  File "/usr/lib64/python3.6/http/client.py", line 1346, in getresponse
    response.begin()
  File "/usr/lib64/python3.6/http/client.py", line 307, in begin
    version, status, reason = self._read_status()
  File "/usr/lib64/python3.6/http/client.py", line 268, in _read_status
    line = str(self.fp.readline(_MAXLINE + 1), "iso-8859-1")
  File "/usr/lib64/python3.6/socket.py", line 586, in readinto
    return self._sock.recv_into(b)
  File "/usr/lib64/python3.6/ssl.py", line 968, in recv_into
    return self.read(nbytes, buffer)
  File "/usr/lib64/python3.6/ssl.py", line 830, in read
    return self._sslobj.read(len, buffer)
  File "/usr/lib64/python3.6/ssl.py", line 587, in read
    v = self._sslobj.read(len, buffer)
socket.timeout: The read operation timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/requests/adapters.py", line 449, in send
    timeout=timeout
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 638, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/lib/python3.6/site-packages/urllib3/util/retry.py", line 368, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/usr/lib/python3.6/site-packages/urllib3/packages/six.py", line 693, in reraise
    raise value
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 600, in urlopen
    chunked=chunked)
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 386, in _make_request
    self._raise_timeout(err=e, url=url, timeout_value=read_timeout)
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 306, in _raise_timeout
    raise ReadTimeoutError(self, url, "Read timed out. (read timeout=%s)" % timeout_value)
urllib3.exceptions.ReadTimeoutError: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Read timed out. (read timeout=45)

During handling of the above exception, another exception occurred:

requests.exceptions.ReadTimeout: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Read timed out. (read timeout=45)
Please see the logfiles in /var/log/letsencrypt for more details.

Etwas Recherche führt mich hierher
- HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Read timed out - #4 by Brian_Peach - Help - Let's Encrypt Community Support
- und weiter zu diesem hier
  Cannot get new certificate, readtimeout error - #10 by _az - Help - Let's Encrypt Community Support
ifconfig eth0 mtu 1300

Dann noch einmal bash -x renew-le.sh --first-time

IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
  /root/freeipa-letsencrypt/0001_chain.pem
  Your cert will expire on 2020-08-14. To obtain a new or tweaked
  version of this certificate in the future, simply run certbot
  again. To non-interactively renew *all* of your certificates, run
  "certbot renew"
- If you like Certbot, please consider supporting our work by:

  Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
  Donating to EFF:                    https://eff.org/donate-le

Wir haben nun eine FreeIpa Instanz ipa.makerspace-gt.de

Wer hilft mit beim Einrichten der Benutzen? @CommanderRiker?