August 2017 - FreeIPA-users - Fedora mailing-lists

AD trust and ACL on OUs
by Sigbjorn Lie-Soland 26 Aug '17

26 Aug '17

Hi list, I have an issue with an AD one-way trust to IPA, where the AD is configured with a very specific set of ACL's on the various OUs where the user accounts live. Authenticated Users cannot search for all users in the AD LDAP directory. This is done as the AD is hosting a multi-tenant environment, and there exists a requirement for different customers accounts not to be visible by everyone. The issue for IPA is when SSSD is attempting to look up the users details in AD via LDAP, using it's trust account (cn=IPADOM$,cn=Users,dc=ad,dc=local). This trust account does not have the required permissions to search for all the users in the AD LDAP tree, the AD user is not found by SSSD, and is denied logon access. As the IPADOM$ account is a special trust account, it is not possible to add this account to the AD group which is normally used to grant access to service accounts to read the entire AD LDAP directory. I have verified the issue by kinit a TGT using the /var/lib/sss/keytabs/AD-TRUST.keytab, and using ldapsearch -Y GSSAPI to query for the exact ldap query I noticed failing in the sssd log /var/log/sssd/sssd_ipa.dns.domain.log. The result is user is *not* found. If I kinit administrator(a)AD.DOMAIN and run the exact same LDAP query using ldapsearch -Y GSSAPI, the user *is* found. If (for testing purposes) the "Authenticated Users" group is granted access on the OU's containing the AD users, IPA+trust+SSSD works, is able to find the user, and the AD user is able to log on to Linux. Any attempt to add the IPADOM$ account to the OU's ACL has failed, as the user is an hidden account in AD. So I wonder if it is possible to specify a different AD LDAP account for SSSD to use for it's LDAP trust lookups towards AD? Or perhaps there is a better way to solve this issue? Any pointers and advice is greatly appreciated. Regards, Siggi

2 2

FreeIPA NFS4 Kerberos and Autofs Errors mounting user home directories
by Kofi ANSA AKUFO 25 Aug '17

25 Aug '17

Dear All I am having difficulty getting freeipa server (centos 7..3) and clients (centos7.3 and debian 9) to working. Scenario ipasvr2.inetcom.lan (centos7.3 hosting freeipa server) nfs2.inetcom.lan (centos 7.3 freeipa client also running nfs server) vpn.inetcom.lan (debian 9 freeipa client hosting open vpn) Clients are are to realm and I cal acquire and list tickets on both clients and server. The issue is userdirs mapping is not working when user logs into the ipasvr2 or vpn hosts. They are able to login but their userdirs are not mapped. However the directories are mounted when they login to the nfs2 host. Below are the logs from /var/log/krb5kdc.log Aug 26 03:14:24 ipasvr2.inetcom.lan krb5kdc[2454](info): closing down fd 12 Aug 26 03:14:24 ipasvr2.inetcom.lan krb5kdc[2453](info): TGS_REQ (3 etypes {18 1 23}) 10.7.7.4: ISSUE: authtime 1503717264, etypes {rep=18 tkt=18 ses=18}, host/ipasvr2.inetcom.lan(a)INETCOM.LAN for ldap/ipasvr2.inetcom.lan(a)INETCOM.LAN Aug 26 03:14:24 ipasvr2.inetcom.lan krb5kdc[2453](info): closing down fd 12 Aug 26 03:14:38 ipasvr2.inetcom.lan krb5kdc[2456](info): AS_REQ (3 etypes {18 1 23}) 10.7.7.8: NEEDED_PREAUTH: host/nfs2.inetcom.lan(a)INETCOM.LAN for krbtgt/INETCOM.LAN(a)INETCOM.LAN, Additional pre-authentication required Aug 26 03:14:38 ipasvr2.inetcom.lan krb5kdc[2456](info): closing down fd 12 Aug 26 03:14:38 ipasvr2.inetcom.lan krb5kdc[2454](info): AS_REQ (3 etypes {18 1 23}) 10.7.7.8: ISSUE: authtime 1503717278, etypes {rep=18 tkt=18 ses=18}, host/nfs2.inetcom.lan(a)INETCOM.LAN for krbtgt/INETCOM.LAN(a)INETCOM.LAN Aug 26 03:14:38 ipasvr2.inetcom.lan krb5kdc[2454](info): closing down fd 12 Aug 26 03:14:38 ipasvr2.inetcom.lan krb5kdc[2455](info): TGS_REQ (3 etypes {18 1 23}) 10.7.7.8: ISSUE: authtime 1503717278, etypes {rep=18 tkt=18 ses=18}, host/nfs2.inetcom.lan(a)INETCOM.LAN for ldap/ipasvr2.inetcom.lan(a)INETCOM.LAN Aug 26 03:14:38 ipasvr2.inetcom.lan krb5kdc[2455](info): closing down fd 12 and this from /var/log/messages Aug 26 03:18:41 ipasvr2 automount[1228]: handle_packet_missing_indirect: token 93, name admin, request pid 3113 Aug 26 03:18:41 ipasvr2 automount[1228]: dev_ioctl_send_fail: token = 93 Aug 26 03:18:41 ipasvr2 automount[1228]: handle_packet: type = 3 Aug 26 03:18:41 ipasvr2 automount[1228]: handle_packet_missing_indirect: token 94, name admin, request pid 3113 Aug 26 03:18:41 ipasvr2 automount[1228]: dev_ioctl_send_fail: token = 94 Freeipa version 4.4.0 grateful to assist to resolve issue. cheers

1 0

Host does not have corresponding DNS A/AAAA record error when running ipa service-add
by Arnold Werschky 25 Aug '17

25 Aug '17

Hello all, We're trying to install integrate a samba server with ipa. Our install is going well, until we get to the command: #> ipa service-add cifs/myshare.my.domain I get the response: #> ipa: ERROR: Host 'myshare.my.domain' does not have corresponding DNS A/AAAA record Which is not true, because this command: #> ipa dnsrecord-find my.domain myshare returns: Record name: myshare A record: 10.X.XX.XXX SSHFP record: 1 1 HASH, 1 2 HASH, 3 1 HASH, 3 2 HASH, 4 1 HASH, 4 2 HASH ---------------------------- Number of entries returned 1 ---------------------------- Any ideas where to turn from here? I'm running redhat 7.4 with latest updates, ipa-server-4.5.0-21.el7

1 0

Centos/Redhat 7.4
by Lachlan Musicman 25 Aug '17

25 Aug '17

What version of IPA is available in 7.4? cheers L. ------ "The antidote to apocalypticism is *apocalyptic civics*. Apocalyptic civics is the insistence that we cannot ignore the truth, nor should we panic about it. It is a shared consciousness that our institutions have failed and our ecosystem is collapsing, yet we are still here — and we are creative agents who can shape our destinies. Apocalyptic civics is the conviction that the only way out is through, and the only way through is together. " *Greg Bloom* @greggish https://twitter.com/greggish/status/873177525903609857

6 7

FreeIPA vault with ActiveDirectory user
by Bjoern Klimpel 25 Aug '17

25 Aug '17

Hi, We use the following environment: OS CentOS 7.3 / latest FreeIPA 4.4.0 Is it possible to get access with an active directory user to the FreeIPA vault ? If yes do you got a hint for me how to do this or where i can find documentation? with best regards Björn

3 4

site server lookup query
by Craig H Silva (CenITex) 24 Aug '17

24 Aug '17

The circumstances/environment are a little unusual. We have a secure zone in which Windows AD has read-only domain controllers as a security measure which we use to authenticate against. The read-write DC's are firewalled off but are assigned the core roles (I'm more linux than Windows - I forget what roles they are). So we have a rhel 7.2 system sssd -1.13.0-40 and it has the following in its sssd.conf: dns_discovery_domain = XX-XXX-XXX-PRIV._sites.domain.xx.xx.xx ad_site = XX-XXX-XXX-PRIV ad_enable_dns_sites = true and it happily identifies the RODC's in the site XX-XXX-XXX-PRIV with SRV query to _ldap._tcp. XX-XXX-XXX-PRIV._sites. domain.xx.xx.xx On the other hand we have a SLES 12 Sp2 system in the same zone and when we configure it the same way, it cannot discover the RODC's in the XX-XXX-XXX-PRIV site, so we have worked around by putting them in as ad_servers. The sles 12 sp2 version of sssd is sssd-1.11.5.1 Our preference is to not have to rely on hardcoded server addresses so the rhel config is preferred and I imagine the SLES one will catch up as the updated versions are released on SLES, however I was wondering how AD site discovery worked and whether my assumption that the firewall is blocking that discovery (i. e. putting the site into dns_discovery_domain setting) is correct. Cheers Craig Silva Specialist Engineer CenItex | Level 15, 80 Collins Street, Melbourne 3000 ph: +61 3 8688 1297 | mob: +61 429 365 609 | email: craig.silva(a)cenitex.vic.gov.au<mailto:craig.silva@cenitex.vic.gov.au> | www.cenitex.vic.gov.au<http://www.cenitex.vic.gov.au/> Supporting a modern, agile and productive public sector through what we value: Accountability, Collaboration, Respect, Initiative, Courage. _________________________________________________________________________________________ Any personal or sensitive information contained in this email and attachments must be handled in accordance with the Victorian Privacy and Data Protection Act 2014, the Health Records Act 2001 or the Privacy Act 1988 (Commonwealth), as applicable. This email, including all attachments, is confidential. If you are not the intended recipient, you must not disclose, distribute, copy or use the information contained in this email or attachments. Any confidentiality or privilege is not waived or lost because this email has been sent to you in error. If you have received it in error, please let us know by reply email, delete it from your system and destroy any copies.

2 1

password and keytab weirdness
by Kat 24 Aug '17

24 Aug '17

Hi all, Has anyone seen this before: 1. User created, and being used for logins, no issues. Works just fine. 2. At one point, keytab file is retrieved via getkeytab, which also works. 3. After the keytab is retrieved, the password no longer seems to work??? Weirdness - am I missing something here? This can be repeated with any user set to retrieve their keytab. -K

2 1

Preauthentication failed - what does this mean?
by Detlev Habicht 23 Aug '17

23 Aug '17

Hi, i have maybe an IPA server which is a little bit broken (My NFS services don’t work, i can’t mount - the rest is working.). I see this messages: ipa-client-install: Kerberos authentication failed: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529638936): Preauthentication failed Installation failed. Force set so not rolling back changes. krb5kdc.log: Aug 23 10:49:26 pipa.ims.intern krb5kdc[2333](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 130.75.57.122: NEEDED_PREAUTH: host/pxe-122.ims.intern(a)IMS.INTERN for krbtgt/IMS.INTERN(a)IMS.INTERN, Additional pre-authentication required Aug 23 10:49:26 pipa.ims.intern krb5kdc[2334](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 130.75.57.122: PREAUTH_FAILED: host/pxe-122.ims.intern(a)IMS.INTERN for krbtgt/IMS.INTERN(a)IMS.INTERN, Preauthentication failed What does this mean? What can be broken on the IPA server? Thanx for any help! Detlev -- Detlev | Institut fuer Mikroelektronische Systeme Habicht | D-30167 Hannover +49 511 76219662 habicht(a)ims.uni-hannover.de --------+-------- Handy +49 172 5415752 ---------------------------

2 1

Free IPA/LDAP migration
by Ed Aiduc 23 Aug '17

23 Aug '17

Hi! I'am a newbie here.. I just have a question with regards to LDAP. I have two free ipa server, one with ldap and the other one has no ldap on it, I wanted to transfer/migrate the ldap config from one server to another server with no ldap, is it possible? I'm searching the internet but can't find any source I can use to as reference. Hoping for your kind response. Thank you!

4 5

VPN -> Radius -> IPA Using two factor authentication
by Gabriel Faber 22 Aug '17

22 Aug '17

Hi All, I'm trying to set up a Cisco/Meraki VPN appliance to authenticate to FreeIPA using two factor authentication (I have Google Authenticator and Yubikey set up and working in FreeIPA) Meraki can do Radius to authenticate a user I've set up a FreeRadius server and set it up to use FreeIPA as the authentication source I tried the following as the back end in Radius: LDAP: can authenticate both with password and password+OTP, but if I want to enforce OTP on VPN, I need to enforce OTP on all users, which is not what we want Kerberos: I've set up a 'vpn' principle and can enforce 2FA on it First I got 'ERROR: krb5 : Error verifying credentials (-1765328174): Generic preauthentication failure', so I set up 'Anonymous kerberos' (which is an adventure by itself), but it's still not working It might be possible to use Radius -> PAM, but I'm not sure how Any help appreciated, Gabriel P.s. Meraki Wireless (WPA2-Enterprise) and 802.1x port security work fine against the Radius server (No 2FA required) -- Gabriel Faber Senior Operations Engineer SoundHound Inc. 408-441-3267

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users August 2017