January 2019 - FreeIPA-users - Fedora mailing-lists

Re: Peer certificate cannot be authenticated with given CA certificates
by Petr Beňas 09 Jan '19

09 Jan '19

Hi German, thanks for having a look into this. There is no customer case in the RedHat portal. We're using the upstream FreeIPA from CentOS. Attaching the /var/log/pki/pki-tomcat/ca/debug log. The timestamp of the resubmission was Sat Nov 10 12:03:23 CET 2018 (time set back prior the expiration). I don't see anything interesting from that time, though the getcert list suggests it tried to talk to the ipa07 from which the debug log was collected. ca-error: Error 60 connecting to https://ipa07.example.com:8443/ca/agent/ca/profileReview: Peer certificate cannot be authenticated with given CA certificates. Did not perform a full restore from backup since it would require a re-initialization from single replica, which possesses a risk of losing more CA replicas. However I confirmed the contents of /etc/pki/pki-tomcat/alias are identical to other replicas, where no manual changes were made. Can't restore the deleted CSR from o=ipaca, since I don't have a backup of it. We have full backups (/usr/sbin/ipa-backup) of other replica, so theoretically it should be possible to get if from there, but we're getting the same error regardless the CSR removal. I've also checked that cn=EXAMPLE.COM IPA CA,cn=certificates,cn=ipa,cn=etc,dc=example,dc=com contains the latest CA cert. This is the output of requested commands. Same output also on a different replica. [root@ipa07:/] certutil -V -d /etc/pki/pki-tomcat/alias -n "ocspSigningCert cert-pki-ca" -u O certutil: certificate is valid [root@ipa07:/] certutil -V -d /etc/pki/pki-tomcat/alias -n "subsystemCert cert-pki-ca" -u C certutil: certificate is valid [root@ipa07:/] certutil -V -d /etc/pki/pki-tomcat/alias -n "Server-Cert cert-pki-ca" -u V certutil: certificate is valid [root@ipa07:/] certutil -V -d /etc/pki/pki-tomcat/alias -n "auditSigningCert cert-pki-ca" -u J certutil: certificate is valid [root@ipa07:/] certutil -V -d /etc/pki/pki-tomcat/alias -n "caSigningCert cert-pki-ca" -u L certutil: certificate is valid Thanks Petr On Tue, Jan 8, 2019 at 5:13 PM German Parente <gparente(a)redhat.com> wrote: > Hi Petr, > > I was asked to take a look at this issue. I wanted to know if, in > parallel, there is a customer case open in redhat portal. > > If not, could you provide the /var/log/pki-tomcat/ca/debug log file and > the timestamp of resubmission ? > > I would not change manually the cert db's under /etc/pki/pki-tomcat/alias > not delete or recreate any object under o=ipaca, as possible. If you have > backups, please restore to original ones. > > I know about issues with certificate encoding. In general, the error I use > to see is a little bit different like "error -8179:Peer's Certificate > issuer is not recognized". > > It could be interesting to check your certificates in cert db once date > has been set back by doing: > > certutil -V -d /etc/pki/pki-tomcat/alias -n "ocspSigningCert cert-pki-ca" -u O > > certutil -V -d /etc/pki/pki-tomcat/alias -n "subsystemCert cert-pki-ca" -u C > > certutil -V -d /etc/pki/pki-tomcat/alias -n "Server-Cert cert-pki-ca" -u V > > certutil -V -d /etc/pki/pki-tomcat/alias -n "auditSigningCert cert-pki-ca" -u J > > certutil -V -d /etc/pki/pki-tomcat/alias -n "caSigningCert cert-pki-ca" -u L > > that is more or less where our selftests are doing for PKI component. > > Thanks and regards, > > German. > > > > > On Fri, Jan 4, 2019 at 1:44 PM Petr Benas via FreeIPA-users < > freeipa-users(a)lists.fedorahosted.org> wrote: > >> Hello, >> >> we have an issue with resubmitting several certificates. >> >> We suspect the reason might be the encoding mismatch between the >> certificate and the CA certificate. >> >> Our environment was upgraded during the years from some 3.x version to >> current 4.5.4. So the very first CA certificate was encoded in >> PRINTABLESTRING. >> >> Issuer: >> organizationName = PRINTABLESTRING:EXAMPLE.COM >> commonName = PRINTABLESTRING:Certificate >> Authority >> Validity >> Not Before: Dec 1 14:14:37 2014 GMT >> Not After : Dec 1 14:14:37 2034 GMT >> Subject: >> organizationName = PRINTABLESTRING:EXAMPLE.COM >> commonName = PRINTABLESTRING:Certificate >> Authority >> >> When we renew-ed (due to SHA1) we got to PRINTABLESTRING X UTF8STRING and >> after we renewed again, so now we have: >> >> Issuer: >> organizationName = UTF8STRING:EXAMPLE.COM >> commonName = UTF8STRING:Certificate Authority >> Validity >> Not Before: Oct 9 07:34:24 2017 GMT >> Not After : Oct 9 07:34:24 2037 GMT >> Subject: >> organizationName = UTF8STRING:EXAMPLE.COM >> commonName = UTF8STRING:Certificate Authority >> >> And most certificated were renewed fine. >> >> However, recently we noticed that several certificated can't be >> resubmitted, all of them seem to be like this: >> >> Issuer: >> organizationName = PRINTABLESTRING:EXAMPLE.COM >> commonName = PRINTABLESTRING:Certificate >> Authority >> Validity >> Not Before: Nov 24 12:17:12 2016 GMT >> Not After : Nov 14 12:17:12 2018 GMT >> Subject: >> organizationName = UTF8STRING:EXAMPLE.COM >> commonName = UTF8STRING:ipa07.example.com >> >> The error when resubmitting is: >> Peer certificate cannot be authenticated with given CA certificates. The >> tcpdump from 8443 says Unknown CA. >> >> Is the assumption that the encoding mismatch is blocking the submitting >> certificate correct? >> One of the certificate which we also can't renew is the 'IPA RA' >> (/var/lib/ipa/ra-agent.pem) >> >> What we tried: >> Add all versions of CA certificate to /etc/pki/pki-tomcat/alias >> trust store (also add them one-by-one) >> Setting date back before the expiration. >> Advises from: >> https://rcritten.wordpress.com/2017/09/20/peer-certificate-cannot-be-authen… >> Deleting the related CSR from o=ipaca, supposing that newly >> generated csr will be fine. >> >> Any suggestions what else we could try? >> >> Thanks >> Petr >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to >> freeipa-users-leave(a)lists.fedorahosted.org >> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: >> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >> >

1 0

Recommendation for adding client with 2 NICs (laptop with LAN & WLAN)
by 74cmonty 09 Jan '19

09 Jan '19

Hi, adding a client in WebUI is simple. However, what do you recommend when adding a client with 2 NICs, e.g. laptop? These devices have typically different NICs for LAN and WLAN. And consequently there are 2 MAC addresses and 2 IPs. But there's only 1 hostname (FQHN). Any advise is appreciated. THX & happy new year!

3 3

pki tomcat issue: Unable to communicate with CMS 500
by Stijn De Weirdt 09 Jan '19

09 Jan '19

hi all, we are running centos76 with ipa-server-4.6.4-10.el7 (one master and one replica; the upgrade went fine on both) and we have a problem with pki tomcat. (we are not sure since when this occurs, but it might be from after the update) ipactl status is ok on both master and replica, pki-tomcatd is running (ports 8080, 8443, 8005 and 8009 are listening) running 'ipa host-disable' fails with > Certificate operation cannot be completed: Unable to communicate with CMS (500) and the only hints i can find are in the /var/log/pki/pki-tomcat/localhost.2019-01-08.log file (the .../ca/debug has nothing relevant). i pasted the backtrace below. any help only how to further investiagte or debug are welcome. stijn > SEVERE: Servlet.service() for servlet [Resteasy] in context with path [/ca] threw exception > org.jboss.resteasy.spi.UnhandledException: Response is committed, can't handle exception > at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:148) > at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:432) > at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:376) > at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179) > at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220) > at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) > at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) > at javax.servlet.http.HttpServlet.service(HttpServlet.java:731) > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) > at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) > at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) > at java.lang.reflect.Method.invoke(Method.java:498) > at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) > at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) > at java.security.AccessController.doPrivileged(Native Method) > at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) > at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) > at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175) > at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:297) > at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55) > at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:191) > at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:187) > at java.security.AccessController.doPrivileged(Native Method) > at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:186) > at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) > at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) > at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) > at java.lang.reflect.Method.invoke(Method.java:498) > at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) > at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) > at java.security.AccessController.doPrivileged(Native Method) > at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) > at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) > at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:260) > at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:237) > at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55) > at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:191) > at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:187) > at java.security.AccessController.doPrivileged(Native Method) > at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:186) > at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218) > at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110) > at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:506) > at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169) > at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) > at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962) > at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) > at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445) > at org.apache.coyote.ajp.AjpProcessor.process(AjpProcessor.java:190) > at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637) > at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316) > at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) > at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) > at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) > at java.lang.Thread.run(Thread.java:748) > Caused by: org.jboss.resteasy.plugins.providers.jaxb.JAXBMarshalException: javax.xml.bind.MarshalException > - with linked exception: > [org.apache.catalina.connector.ClientAbortException: java.net.SocketException: Broken pipe (Write failed)] > at org.jboss.resteasy.plugins.providers.jaxb.AbstractJAXBProvider.writeTo(AbstractJAXBProvider.java:128) > at org.jboss.resteasy.core.interception.AbstractWriterInterceptorContext.writeTo(AbstractWriterInterceptorContext.java:129) > at org.jboss.resteasy.core.interception.ServerWriterInterceptorContext.writeTo(ServerWriterInterceptorContext.java:62) > at org.jboss.resteasy.core.interception.AbstractWriterInterceptorContext.proceed(AbstractWriterInterceptorContext.java:118) > at org.jboss.resteasy.plugins.interceptors.encoding.GZIPEncodingInterceptor.aroundWriteTo(GZIPEncodingInterceptor.java:100) > at org.jboss.resteasy.core.interception.AbstractWriterInterceptorContext.proceed(AbstractWriterInterceptorContext.java:122) > at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:99) > at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:427) > ... 54 more > Caused by: javax.xml.bind.MarshalException > - with linked exception: > [org.apache.catalina.connector.ClientAbortException: java.net.SocketException: Broken pipe (Write failed)] > at com.sun.xml.internal.bind.v2.runtime.MarshallerImpl.write(MarshallerImpl.java:313) > at com.sun.xml.internal.bind.v2.runtime.MarshallerImpl.marshal(MarshallerImpl.java:236) > at javax.xml.bind.helpers.AbstractMarshallerImpl.marshal(AbstractMarshallerImpl.java:95) > at org.jboss.resteasy.plugins.providers.jaxb.AbstractJAXBProvider.writeTo(AbstractJAXBProvider.java:124) > ... 61 more > Caused by: org.apache.catalina.connector.ClientAbortException: java.net.SocketException: Broken pipe (Write failed) > at org.apache.catalina.connector.OutputBuffer.realWriteBytes(OutputBuffer.java:410) > at org.apache.tomcat.util.buf.ByteChunk.flushBuffer(ByteChunk.java:480) > at org.apache.tomcat.util.buf.ByteChunk.append(ByteChunk.java:366) > at org.apache.catalina.connector.OutputBuffer.writeBytes(OutputBuffer.java:435) > at org.apache.catalina.connector.OutputBuffer.write(OutputBuffer.java:423) > at org.apache.catalina.connector.CoyoteOutputStream.write(CoyoteOutputStream.java:91) > at org.jboss.resteasy.plugins.server.servlet.HttpServletResponseWrapper$DeferredOutputStream.write(HttpServletResponseWrapper.java:46) > at org.jboss.resteasy.util.CommitHeaderOutputStream.write(CommitHeaderOutputStream.java:71) > at com.sun.xml.internal.bind.v2.runtime.output.UTF8XmlOutput.write(UTF8XmlOutput.java:396) > at com.sun.xml.internal.bind.v2.runtime.output.Encoded.write(Encoded.java:152) > at com.sun.xml.internal.bind.v2.runtime.output.UTF8XmlOutput.doText(UTF8XmlOutput.java:308) > at com.sun.xml.internal.bind.v2.runtime.output.UTF8XmlOutput.text(UTF8XmlOutput.java:290) > at com.sun.xml.internal.bind.v2.runtime.XMLSerializer.leafElement(XMLSerializer.java:313) > at com.sun.xml.internal.bind.v2.model.impl.RuntimeBuiltinLeafInfoImpl$StringImplImpl.writeLeafElement(RuntimeBuiltinLeafInfoImpl.java:1036) > at com.sun.xml.internal.bind.v2.model.impl.RuntimeBuiltinLeafInfoImpl$StringImplImpl.writeLeafElement(RuntimeBuiltinLeafInfoImpl.java:1015) > at com.sun.xml.internal.bind.v2.runtime.reflect.TransducedAccessor$CompositeTransducedAccessorImpl.writeLeafElement(TransducedAccessor.java:239) > at com.sun.xml.internal.bind.v2.runtime.property.SingleElementLeafProperty.serializeBody(SingleElementLeafProperty.java:115) > at com.sun.xml.internal.bind.v2.runtime.ClassBeanInfoImpl.serializeBody(ClassBeanInfoImpl.java:345) > at com.sun.xml.internal.bind.v2.runtime.XMLSerializer.childAsXsiType(XMLSerializer.java:681) > at com.sun.xml.internal.bind.v2.runtime.property.ArrayElementNodeProperty.serializeItem(ArrayElementNodeProperty.java:54) > at com.sun.xml.internal.bind.v2.runtime.property.ArrayElementProperty.serializeListBody(ArrayElementProperty.java:157) > at com.sun.xml.internal.bind.v2.runtime.property.ArrayERProperty.serializeBody(ArrayERProperty.java:144) > at com.sun.xml.internal.bind.v2.runtime.ClassBeanInfoImpl.serializeBody(ClassBeanInfoImpl.java:350) > at com.sun.xml.internal.bind.v2.runtime.ClassBeanInfoImpl.serializeBody(ClassBeanInfoImpl.java:336) > at com.sun.xml.internal.bind.v2.runtime.XMLSerializer.childAsSoleContent(XMLSerializer.java:578) > at com.sun.xml.internal.bind.v2.runtime.ClassBeanInfoImpl.serializeRoot(ClassBeanInfoImpl.java:326) > at com.sun.xml.internal.bind.v2.runtime.XMLSerializer.childAsRoot(XMLSerializer.java:479) > at com.sun.xml.internal.bind.v2.runtime.MarshallerImpl.write(MarshallerImpl.java:308) > ... 64 more > Caused by: java.net.SocketException: Broken pipe (Write failed) > at java.net.SocketOutputStream.socketWrite0(Native Method) > at java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:111) > at java.net.SocketOutputStream.write(SocketOutputStream.java:155) > at org.apache.coyote.ajp.AjpProcessor.output(AjpProcessor.java:298) > at org.apache.coyote.ajp.AbstractAjpProcessor$SocketOutputBuffer.doWrite(AbstractAjpProcessor.java:1275) > at org.apache.coyote.Response.doWrite(Response.java:499) > at org.apache.catalina.connector.OutputBuffer.realWriteBytes(OutputBuffer.java:405) > ... 91 more

2 2

FreeIPA web UI Failed
by mustafa taha 08 Jan '19

08 Jan '19

Hi i am new user of Freeipa i have built two Freeipa one server and other replica . the problem is when i enter authenticate in the web UI , this message appear : >>> Some operations failed. Hide details The search criteria was not specific enough. Expected 1 and found 2. <<< if i press ok , then this page appear : >>> Runtime error Web UI got in unrecoverable state during "runtime" phase. Technical details: Unable to get property 'ipapwdexpadvnotify' of undefined or null reference TypeError: Unable to get property 'ipapwdexpadvnotify' of undefined or null reference at y.update_password_expiration (https://ipa0.exalt.ps/ipa/ui/js/freeipa/app.js?40604:1:37107) at start_runtime (https://ipa0.exalt.ps/ipa/ui/js/freeipa/app.js?40604:1:17251) at Anonymous function (https://ipa0.exalt.ps/ipa/ui/js/freeipa/app.js?40604:1:1246) at Anonymous function (https://ipa0.exalt.ps/ipa/ui/js/freeipa/app.js?40604:1:3474) at a.forEach (https://ipa0.exalt.ps/ipa/ui/js/dojo/dojo.js?v=40604:1:29752) at _run_phase (https://ipa0.exalt.ps/ipa/ui/js/freeipa/app.js?40604:1:3440) at next_phase (https://ipa0.exalt.ps/ipa/ui/js/freeipa/app.js?40604:1:3899) at Anonymous function (https://ipa0.exalt.ps/ipa/ui/js/freeipa/app.js?40604:1:3570) at c (https://ipa0.exalt.ps/ipa/ui/js/dojo/dojo.js?v=40604:1:60954) at t.then (https://ipa0.exalt.ps/ipa/ui/js/dojo/dojo.js?v=40604:1:62155) <<< i reach to this problem after i use "ipa idrange" i use this command because i have two ID range and i want to delete the deleted one but when i try that , a suggestion note appear an tell me to use this command . can anybody help ?

2 1

Cert issue on master IPA server
by Mitchell Smith 08 Jan '19

08 Jan '19

Hi List, I am running in to an issue joining a new replica to our IPA environment. It’s worth noting that we have had issues with expired certs on our master server for a while but I thought we had resolved them, and when I connect to ports 443 and 636 on the master server I get certs back expiring in 2020. So I have run IPA-client-install and the client joins successfully. I can ‘kinit admin’ and kerberos auth appears to work. When I run ipa-replica-install it hangs on step 27 restarting directory server. When I check syslog I see that dirsrv has failed to restart, and the following message. Jan 8 02:20:11 ds02 certmonger[8516]: 2019-01-08 02:20:11 [8516] Server at https://ds01.prod.xyz.internal/ipa/xml failed request, will retry: 907 (RPC failed at server. cannot connect to 'https://ds01.prod.xyz.internal:443/ca/eeca/ca/profileSubmitSSLClient': (SSL_ERROR_EXPIRED_CERT_ALERT) SSL peer rejected your certificate as expired.). Where ds02 is the new replica I am installing and ds01 is the original master. Running FreeIPA 4.3.1. Any suggestions on how to move past this point would be greatly appreciated. Thanks in advance.

2 2

IPA Server SSL RC4 Cipher Suites on Port 443
by Christopher Lamb 08 Jan '19

08 Jan '19

2 3

Samba server on Ubuntu not working
by Kees Bakker 08 Jan '19

08 Jan '19

Hey, Is there any chance that the combination FreeIPA + Samba + Ubuntu is going to work in the near future? So far I haven't been able to. The main purpose is to give Windows users access to disk space on our (Ubuntu) servers. And with their IPA credentials. I know that Alexander knows a whole lot about Samba and FreeIPA. But not so much about the combination with Ubuntu, I think (except that Heimdal versus MIT Kerberos plays a role). Timo may know more about the Ubuntu part, but I don't think he has the whole setup with FreeIPA+Samba. In 2016 (yes, that long ago) Alexander wrote [1] "Let me comment as FreeIPA and Samba upstream developer. Ubuntu's Samba build is done with Heimdal and you cannot build ipasam.so against Heimdal, only MIT Kerberos. So you cannot use Ubuntu-provided Samba build this way even if you'd recompile FreeIPA with patches we have upstream to deal with libpdb -> libsamba-pdb library name change. So until Samba in Debian and Ubuntu is built against Heimdal Kerberos (this is due to Debian/Ubuntu packaging Samba AD, not just Samba) it is unlikely to have FreeIPA trust to AD working in Ubuntu. We are fairly close with completing port of Samba AD to MIT Kerberos upstream, this should happen in Samba 4.5-4.6 timeframe. Once that is done, we can expect FreeIPA with trust to AD working on Debian-based platforms as well." It's 2019 now. I've tried Ubuntu 18.04 (with Samba 4.7.6), but I still can't get it to work. Possibly because MIT KDC is not enabled in Ubuntu's samba [2]. The following test shows empty. # smbd -b | grep HAVE_LIBKADM5SRV_MIT Argh, what are my options? [1] https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1552249/comments/2 [2] https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC -- Kees Bakker

2 3

How to restrict access for users to specific hosts
by 74cmonty 07 Jan '19

07 Jan '19

Hi, how can I restrict access for users to specific hosts? Please advise. THX

3 3

How to restrict access by only users of a specific AD group
by Dmitrii M 04 Jan '19

04 Jan '19

Hi, I have a FreeIPA server as server.ipa.linux.dom, domain name is ipa.linux.dom with a configured one-way trust with Windows Server 2016 Active Directory domain as windows.dom. I can log in to linux clients by ssh using AD accounts like ssh aduser@window.dom@hostname. It works just fine thanks to the groups created with --external option. kinit <ipauser> and kinit <aduser(a)windows.dom> also work. Now my next phase is to configure some applications so AD users should be able to authenticate in those apps. And also I need to restrict such access by only users who are members of specific AD groups. I started doing this for Apache using its mod_ldap module. Below is a config that I am trying to get working. If I put "Require valid-user" option in the below config it confirms that I can authenticate in Apache using my AD account. Now I need to restrict access to Apache by only the users who are in the apacheusers(a)windows.dom AD group. This is a current Apache config which I cannot properly set up and I need your help in this. # https://httpd.apache.org/docs/2.4/mod/mod_authnz_ldap.html <Directory /var/www/html/auth-ldap> Order deny,allow Allow from All AuthName "LDAP Authentication" AuthType Basic AuthBasicProvider ldap AuthLDAPUrl ldap://server.ipa.linux.dom/dc=ipa,dc=linux,dc=dom?uid?sub AuthLDAPBindDN uid=apachebind,cn=users,cn=accounts,dc=ipa,dc=linux,dc=dom AuthLDAPBindPassword Admin123 AuthLDAPGroupAttributeIsDN off AuthLDAPGroupAttribute memberUid Require ldap-group cn=apacheusers_ad(a)windows.dom,cn=groups,cn=compat,dc=ipa,dc=linux,dc=dom </Directory> uid=apachebind is a user created in FreeIPA. cn=apacheusers_ad(a)windows.dom is a group name added to Default Trust View as an overridden AD group apacheusers(a)windows.dom. The above config is based on the info which I get if I run such ldapsearch command. It tells that I need to check apacheusers_ad(a)windows.dom group to define members of that group. $ ldapsearch -Y GSSAPI -b 'dc=ipa,dc=linux,dc=dom' "(&(objectClass=posixGroup)(cn=apacheusers_ad(a)windows.dom))" SASL/GSSAPI authentication started SASL username: admin(a)IPA.LINUX.DOM SASL SSF: 256 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <dc=ipa,dc=linux,dc=dom> with scope subtree # filter: (&(objectClass=posixGroup)(cn=apacheusers_ad(a)windows.dom)) # requesting: ALL # # apacheusers_ad(a)windows.dom, groups, compat, ipa.linux.dom dn: cn=apacheusers_ad(a)windows.dom,cn=groups,cn=compat,dc=ipa,dc=linux,dc=dom objectClass: posixGroup objectClass: ipaOverrideTarget objectClass: top gidNumber: 1000111 memberUid: hassudo(a)windows.dom memberUid: apacheuser(a)windows.dom memberUid: apachebind(a)windows.dom memberUid: user2(a)windows.dom memberUid: user1(a)windows.dom ipaAnchorUUID:: OlNJRDpTLTEtNS0yMS0xODk0OTg2MDMtMjU5NDAxODQ4OC0xNDAzMzI5NDE1LT ExMDk= cn: apacheusers_ad(a)windows.dom # search result search: 4 result: 0 Success # numResponses: 2 # numEntries: 1 I'm trying to log in to Apache as user1(a)windows.dom user $ id -a uid=1959401104(user1(a)windows.dom) gid=1959401104(user1(a)windows.dom) groups=1959401104(user1@windows.dom),1000111(apacheusers_ad@windows.dom),117000008(apacheusers),1959400513(domain users@windows.dom),1959401105(winusers@windows.dom) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 The group 117000008(apacheusers) is a IPA group, AD group added to this as an external member. But I don't understand how to verify in Apache whether user1 a member of it. So I tried two options: ID Views and IDM Group with an external member apacheusers(a)windows.dom but still didn't find how a ldap filter in Apache should look like. I suppose that I miss something but I don't understand what. Sorry for so long text but I am working on this problem for a few days already and still don't have a proper result. I just need to restrict access to Apache by the users who are members of AD group apacheusers(a)windows.dom. Here are software versions. FreeIPA server 7.6.1810 and a client are the same OS version but there are also some plans to connect Ubuntu 14.04 and 16.04 clients. Server packages versions: $ rpm -qa | grep -E '^(ipa|sss)' sssd-krb5-common-1.16.2-13.el7.x86_64 sssd-ldap-1.16.2-13.el7.x86_64 sssd-1.16.2-13.el7.x86_64 ipa-server-trust-ad-4.6.4-10.el7.centos.x86_64 ipa-common-4.6.4-10.el7.centos.noarch ipa-client-common-4.6.4-10.el7.centos.noarch sssd-client-1.16.2-13.el7.x86_64 sssd-common-1.16.2-13.el7.x86_64 sssd-common-pac-1.16.2-13.el7.x86_64 sssd-ad-1.16.2-13.el7.x86_64 sssd-krb5-1.16.2-13.el7.x86_64 sssd-proxy-1.16.2-13.el7.x86_64 ipa-server-dns-4.6.4-10.el7.centos.noarch sssd-ipa-1.16.2-13.el7.x86_64 sssd-dbus-1.16.2-13.el7.x86_64 ipa-client-4.6.4-10.el7.centos.x86_64 ipa-server-4.6.4-10.el7.centos.x86_64 ipa-server-common-4.6.4-10.el7.centos.noarch Active Directory is run on Windows 2016 server in default configuration. Also learnt threads in redhat & freeipa mail lists but didn't find a proper solution for me. I am thankful for any help, Dmitrii

1 0

Service named-pkcs11.service on replica reports error: Failed to get initial credentials (TGT) using principal 'DNS/ipa-replica.example.com' and keytab 'FILE:/etc/named.keytab' (Generic error (see e-text))
by 74cmonty 04 Jan '19

04 Jan '19

Hi, when I start service `named-pkcs11.service` on replica server I get these error messages: ``` Dez 29 17:33:28 ipa-replica.example.com named-pkcs11[3936]: Failed to get initial credentials (TGT) using principal 'DNS/ipa-replica.example.com' and keytab 'FILE:/etc/named.keytab' (Generic error (see e-text)) [...] Dez 29 17:34:04 ipa-replica.example.com ipa-dnskeysyncd[3942]: ipa-dnskeysyncd: CRITICAL Kerberos authentication failed: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529638972): Generic error (see e-text) Dez 29 17:34:04 ipa-replica.example.com systemd[1]: ipa-dnskeysyncd.service: Main process exited, code=exited, status=1/FAILURE ``` The service is starting successfully though. The full log is available here: http://freetexthost.com/e53jnsslf1 What's causing this error?

2 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2019