October 2019 - FreeIPA-users - Fedora mailing-lists

Re: Ipa user can't login via ssh
by Rob Crittenden 14 Oct '19

14 Oct '19

Elhamsadat Azarian wrote: > I tryed to add HBAC rules to my user but it said : some operation > failed. Users cannot be added when user category = all Adding list back. Try something like: ipa hbactest --user elham --service ssh --host <your host> There is an equivalent way to do it in the UI. rob > > On Wed, 9 Oct 2019, 17:19 Rob Crittenden, <rcritten(a)redhat.com > <mailto:rcritten@redhat.com>> wrote: > > Kevin Vasko via FreeIPA-users wrote: > > Have you made sure your “elham” user has the correct permissions > to access the machines? Take a look in the UI at the > groups/permissions that user elham has. Take a look at your HBAC > rules as well. That would be my first recommendation to check if it > was me. > > Right, and the troubleshooting page suggests that (and increasing debug > logging). > > Please provide the output of the things you have already looked at. > > rob > > > > > -Kevin > > > >> On Oct 9, 2019, at 7:23 AM, Elhamsadat Azarian via FreeIPA-users > <freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> wrote: > >> > >> ### Request for enhancement > >> as a Linux admin i want to login into my ipa client with a user > that is defined in ipa-server UI. > >> > >> ### Issue > >> I installed Ipa-server and an Ipa-client on CentOS7.6 > >> I defined Internal DNS on ipa-server and i defined A and PTR > records for client on ipa-server. > >> now i can see my client in ipa-UI and i defined a user with name > "elham" and i expect that it can login into ipa-client. > >> when i login with root in ipa-client and i do sudo elham, it > works and kinit elham works too but > >> when i do ssh into ipa-client with this user, it show "Access denied" > >> i have errors with this context: > >> pam_reply : authentication failure to the client > >> pam_sss: authentication falure > >> > >> im tired of this issue. please help me if you know the solution. > >> > >> #### Steps to Reproduce > >> 1. define new user "elham" in ipa UI > >> 2. SSH to ipa-client with elham > >> 3. access denied > >> > >> #### Actual behavior > >> (what happens) > >> > >> #### Expected behavior > >> login into ipa-client successfully > >> > >> #### Version/Release/Distribution > >> ipa-server 4.6.5-11.el7 > >> ipa-client 4.6.4-10.el7.centos.3 > >> Log files and config files are added below: > >> > >> > >> > >> krb5.conf > >> ------------ > >> #File modified by ipa-client-install > >> > >> includedir /etc/krb5.conf.d/ > >> includedir /var/lib/sss/pubconf/krb5.include.d/ > >> > >> > >> [logging] > >> default = FILE:/var/log/krb5libs.log > >> kdc = FILE:/var/log/krb5kdc.log > >> admin_server = FILE:/var/log/kadmind.log > >> [libdefaults] > >> default_realm = LSHS.DC > >> dns_lookup_realm = false > >> dns_lookup_kdc = false > >> rdns = false > >> ticket_lifetime = 24h > >> forwardable = yes > >> allow_weak_crypto = true > >> default_ccache_name = KEYRING:persistent:%{uid} > >> > >> [realms] > >> LSHS.DC = { > >> kdc = ipa-irvlt01.example.dc:88 > >> admin_server = ipa-irvlt01.example.dc:749 > >> default_domain = example.dc > >> } > >> [domain_realm] > >> .example.com <http://example.com> = LSHS.DC > >> example.com <http://example.com> = LSHS.DC > >> ############################################ > >> > >> > >> sssd.conf > >> ------------- > >> [domain/example.dc] > >> > >> cache_credentials = True > >> krb5_store_password_if_offline = True > >> ipa_domain = example.dc > >> id_provider = ipa > >> auth_provider = ipa > >> access_provider = ipa > >> ldap_tls_cacert = /etc/ipa/ca.crt > >> ipa_hostname = ipacli-irvlt01.example.dc > >> chpass_provider = ipa > >> dyndns_update = True > >> ipa_server = _srv_, ipa-irvlt01.example.dc > >> dyndns_iface = ens160 > >> dns_discovery_domain = example.dc > >> > >> debug_level = 10 > >> [sssd] > >> ########### AFTER IPA ################### > >> #services = nss, sudo, pam, ssh > >> services = nss, pam > >> config_file_version = 2 > >> ######################################### > >> domains = example.dc > >> > >> debug_level = 10 > >> [nss] > >> homedir_substring = /home > >> > >> [pam] > >> debug_level = 10 > >> > >> [sudo] > >> > >> [autofs] > >> > >> [ssh] > >> > >> [pac] > >> > >> [ifp] > >> > >> [secrets] > >> > >> [session_recording] > >> > >> ########################################## > >> > >> > >> _______________________________________________ > >> FreeIPA-users mailing list -- > freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > >> To unsubscribe send an email to > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > >> Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > >> List Guidelines: > https://fedoraproject.org/wiki/Mailing_list_guidelines > >> List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > _______________________________________________ > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > To unsubscribe send an email to > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > > List Guidelines: > https://fedoraproject.org/wiki/Mailing_list_guidelines > > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > >

1 0

automember-add is not clear (at least for me)
by Eugène Adell 13 Oct '19

13 Oct '19

Hello, the documentation (Linux Domain Identity, Authentication, and Policy Guide for RH 7) clearly says the AUTOMEMBER-RULE is in fact a group name, but it's misleading and not intuitive at all. Besides, the help command doesn't mention this. Maybe this point should be improved. For example by adding the option --target mentioning explicitly the group name and then allowing the rule to have a proper name ? best regards E.A. Usage: ipa [global-options] automember-add AUTOMEMBER-RULE [options] Add an automember rule. Options: -h, --help show this help message and exit --desc=STR A description of this auto member rule --setattr=STR Set an attribute to a name/value pair. Format is attr=value. For multi-valued attributes, the command replaces the values already present. --addattr=STR Add an attribute/value pair. Format is attr=value. The attribute must be part of the schema. --type=['group', 'hostgroup'] Grouping to which the rule applies --all Retrieve and print all attributes from the server. Affects command output. --raw Print entries as stored on the server. Only affects output format.

2 1

IPA's Samba fails to start?
by lejeczek 12 Oct '19

12 Oct '19

Hi guys, I have 3 replica setup and on one Samba fails this way: Starting Samba SMB Daemon... [2019/10/12 09:32:06.490263, 0] ipa_sam.c:4385(bind_callback_cleanup) kerberos error: code=-1765328174, message=Pre-authentication failed: Invalid argument [2019/10/12 09:32:06.490570, 0] ../source3/lib/smbldap.c:1052(smbldap_connect_system) failed to bind to server ldapi://%2fvar%2frun%2fslapd-DOM-DIM-PRIVATE.socket with dn="[Anonymous bind]" Error: Local error (unknown) [2019/10/12 09:32:07.500639, 0] ipa_sam.c:4385(bind_callback_cleanup) kerberos error: code=-1765328174, message=Pre-authentication failed: Invalid argument [2019/10/12 09:32:08.508557, 0] ipa_sam.c:4385(bind_callback_cleanup) kerberos error: code=-1765328174, message=Pre-authentication failed: Invalid argument [2019/10/12 09:32:09.517142, 0] ipa_sam.c:4385(bind_callback_cleanup) kerberos error: code=-1765328174, message=Pre-authentication failed: Invalid argument [2019/10/12 09:32:10.527122, 0] ipa_sam.c:4385(bind_callback_cleanup) kerberos error: code=-1765328174, message=Pre-authentication failed: Invalid argument [2019/10/12 09:32:11.537833, 0] ipa_sam.c:4385(bind_callback_cleanup) kerberos error: code=-1765328174, message=Pre-authentication failed: Invalid argument [2019/10/12 09:32:12.546879, 0] ipa_sam.c:4385(bind_callback_cleanup) kerberos error: code=-1765328174, message=Pre-authentication failed: Invalid argument [2019/10/12 09:32:13.553883, 0] ipa_sam.c:4385(bind_callback_cleanup) kerberos error: code=-1765328174, message=Pre-authentication failed: Invalid argument [2019/10/12 09:32:14.561250, 0] ipa_sam.c:4385(bind_callback_cleanup) kerberos error: code=-1765328174, message=Pre-authentication failed: Invalid argument [2019/10/12 09:32:15.569197, 0] ipa_sam.c:4385(bind_callback_cleanup) kerberos error: code=-1765328174, message=Pre-authentication failed: Invalid argument [2019/10/12 09:32:16.578139, 0] ipa_sam.c:4385(bind_callback_cleanup) kerberos error: code=-1765328174, message=Pre-authentication failed: Invalid argument [2019/10/12 09:32:17.585719, 0] ipa_sam.c:4385(bind_callback_cleanup) kerberos error: code=-1765328174, message=Pre-authentication failed: Invalid argument [2019/10/12 09:32:18.593443, 0] ipa_sam.c:4385(bind_callback_cleanup) kerberos error: code=-1765328174, message=Pre-authentication failed: Invalid argument [2019/10/12 09:32:19.602907, 0] ipa_sam.c:4385(bind_callback_cleanup) kerberos error: code=-1765328174, message=Pre-authentication failed: Invalid argument [2019/10/12 09:32:20.612149, 0] ipa_sam.c:4385(bind_callback_cleanup) kerberos error: code=-1765328174, message=Pre-authentication failed: Invalid argument [2019/10/12 09:32:21.620243, 0] ipa_sam.c:4385(bind_callback_cleanup) kerberos error: code=-1765328174, message=Pre-authentication failed: Invalid argument [2019/10/12 09:32:22.621690, 0] ipa_sam.c:4696(pdb_init_ipasam) Failed to get base DN. [2019/10/12 09:32:22.621818, 0] ../source3/passdb/pdb_interface.c:180(make_pdb_method_name) pdb backend ipasam:ldapi://%2fvar%2frun%2fslapd-DOM-DIM-PRIVATE.socket did not correctly init (error was NT_STATUS_UNSUCCESSFUL) smb.service: main process exited, code=exited, status=1/FAILURE Failed to start Samba SMB Daemon. Unit smb.service entered failed state. smb.service failed. Any suggestions on how to troubleshoot & fix are very appreciated. many thanks, L.

1 1

Force users to create OTP token on first login
by Russ Long 11 Oct '19

11 Oct '19

Is there a way to put a policy or something in place, so when users login for the first time, they are forced to create an OTP Token? We need to force OTP into the system as well as the servers that authenticate with it. Thanks!

1 2

ipa-server-install chrony
by Raul Dias 11 Oct '19

11 Oct '19

On Fedora server 30.1.2. Freeipa 4.8.1-1.fc30 Whats does "no" stands for in? Do you want to configure chrony with NTP server or pool address? [no]: -- Att. Raul Dias

2 2

Can't resolve external users on clients, but I can on servers
by S Toulmonde 11 Oct '19

11 Oct '19

Hi, I setup an IPA realm (under rhel7) with an trust relationship to a Windows domain. All users in AD have an idoverride to override uid and gid. Originally, everything was working like expected: servers could resolve IPA and external (trusted) users, I could create kerberos tickets, log-in via ssh... Same for IPA clients. But recently (two weeks ago?), I tried login to an IPA client using an external user and got denied... Debugging, I saw that id and getent wasn't returning any external users, but could return IPA users. Digging a bit more: the ipa servers themselves could resolve both IPA and external users like before. I tried fumbling around in the sssd, but to no avail... I bumped the debug level of the sssd to 9 on the client and the server and this is what I can observe: 0) configure sssd on client to only point to a single IPA server (easier to debug), on that specific IPA server, only point to a single AD server, clear cache and logs, restart sssd on server and client 1) on client, issue 'id myuser' (no domain name, I configured use_fully_qualified_names to False for the domain) -> user unknown 2) client logs: [sssd[be[ipa.domain]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][name=myuser(a)ipa.domain] -> it then saw it's an external user: [sssd[be[ipa.domain]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][name=myuser(a)ad.domain] -> so it sent the request to IPA: [sssd[be[ipa.domain]]] [ipa_s2n_get_acct_info_send] (0x0400): Sending request_type: [REQ_FULL_WITH_MEMBERS] for trust user [myuser(a)ad.domain] to IPA server Spoiler-alert: it fails with: [sssd[be[ipa.domain]]] [sysdb_search_user_by_upn] (0x0400): No entry with upn [myuser(a)ad.domain] found. On the server-side, I receive the request: [sssd[be[ipa.domain]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][name=myuser(a)ad.domain] It resolves the user - fetch all its groups in Windows and seems to process everything correctly (sid resolve...) but I can't find what's the return/status of the request. Seems like this: (Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [get_ldap_conn_from_sdom_pvt] (0x4000): Returning LDAP connection for user lookup. (Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [sdap_id_op_connect_step] (0x4000): beginning to connect (Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'sd_ad.domain.root' (Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [get_server_status] (0x1000): Status of server 'a08238.ad.domain.root' is 'name resolved' (Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 6 seconds (Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [get_server_status] (0x1000): Status of server 'a08238.ad.domain.root' is 'name resolved' (Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [be_resolve_server_process] (0x0200): Found address for server a08238.ad.domain.root: [10.121.129.9] TTL 1236 (Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [sssd_async_socket_init_send] (0x4000): Using file descriptor [29] for the connection. (Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for connecting (Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x558da736b2f0], connected[1], ops[(nil)], ldap[0x558da7367cb0] (Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list Could you please help me on this? Thanks in advance!

2 4

IPA's Certs - country, state, organization ?
by lejeczek 10 Oct '19

10 Oct '19

hi guys, how to manage those? Why are these missing in "standard" IPA installations and how to get them in? many thanks, L.

2 9

Where does the "admin" user get its privileges from?
by Russell Jones 10 Oct '19

10 Oct '19

Hi all, I am still exploring my default setup, and have noticed that while the "admin" user is a part of the admins and trust admins group, neither the user nor those groups have any roles defined on them that I can see. Where is this special username getting its permissions from? Thanks for the help!

2 2

DNS - classless/subnet reverse zones ?
by lejeczek 10 Oct '19

10 Oct '19

hi guys, when I try to add a zone: $ ipa dnszone-add --name-from-ip=10.5.4.128/25 Zone name [4.5.10.in-addr.arpa.]: I see the above. Is what IPA does there correct? Or... what is the recipe for a classless/subnet reverse zone creation? many thanks, L.

2 1

How to change the timeout of 60 seconds on the login with AD users
by SOLER SANGUESA Miguel 10 Oct '19

10 Oct '19

Hi, Thanks for the tip. I try to login executing: ssh -l USER(a)AD.DOMAIN HOSTNAME Unfortunately I have tested with: LOGIN_TIMEOUT 90 And also changing on sshd_conf: LogLevel DEBUG3 ClientAliveInterval 600 LoginGraceTime 600 ClientAliveCountMax 3 And on sssd.conf: ldap_enumeration_search_timeout = 600 But still have a timeout when login process is longer than 60 seconds. I have enabled nscd and then authentication takes less than 60 s and then works, but it will be great if I can know how that timeout can be configured. Thanks & Regards.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users October 2019