April 2019 - FreeIPA-users - Fedora mailing-lists

docker-compose and unnatended install
by Petar Kozić 19 Apr '19

19 Apr '19

Hi, does somebody know how can I do unnatended ipa-server-install with docker-compose ? I tried to add file ipa-server-install-options in /data (/var/lib/ipa-data) with this options: --realm=EXAMPLE.TEST --ds-password=The-directory-server-password --admin-password=The-admin-password as I saw here, but without success. https://hub.docker.com/r/freeipa/freeipa-server/ If someone do that before please can share info :) Thanks. *—* *Petar Kozić*

2 2

Scripting host certificate creation
by Ian Pilcher 18 Apr '19

18 Apr '19

I am trying to script the creation of a bunch of host certificates. Unlike the web UI, the CLI seems to require two separate steps to do this. (Please correct me if I'm wrong about this.) After I generate a key and CSR, I create a certificate with 'ipa cert-request'. I am using host/${HOSTNAME}@${REALM} as the principal, and I am saving the certificate with the --certificate-out option. Now I apparently need to use 'ipa host-add-cert' to add the certificate to the host, but this requires that the certificate be passed in base64 format on the command line. I'm sure I can figure out how to do this with some combination of sed, tr, etc., but this seems excessively painful. Is there really not a way to do this in a single step or feed a PEM-encoded certificate to 'ipa host-add-cert'? -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com -------- "I grew up before Mark Zuckerberg invented friendship" -------- ========================================================================

2 2

Logon returns Insufficient system resources exist to complete the requested service.
by Vex Mage 18 Apr '19

18 Apr '19

Hello, I've personally been using FreeIPA for some time and I love it immensely. I thought I'd start a post here due to the direction my troubleshooting has gone instead of the Samba mailing list. Allow me to explain what I've done, why I've done it and then the problem I'm having. I just recently started working for a school and the school has some Windows labs. A problem that has come to my attention is that the OpenLDAP to Samba3 NT4 domain they've been using for years is no longer compatible with Windows 10. To dispel any illusion, I'm not trying to get the NT4 domain working nice with Windows 10. Additionally Samba4 has changed its design structure such that OpenLDAP, or really any LDAP server except Samba4's internal LDAP server, will no longer work for the Active Directory. The school would like the Windows machines in the labs to authenticate students via their OpenLDAP credentials. I am open to alternatives but the closest thing I found was adding local users on each Windows workstation and having them authenticate to the FreeIPA server. The problem here is that users will continually be added and deleted. The Samba project would have us go all in with Samba4's internal LDAP server. While I'm not directly knocking that, since from my testing it seems to be quite functional, the upheaval would be tremendous. Fortunately we were already looking into switching to 389 before I came on so I've been touting the possibility of replacing OpenLDAP with FreeIPA before this Samba4 issue. A solution I thought should work is to use a trust between a FreeIPA (IPA) and a Samba4 Active Directory (AD). I've since configured both and have created that trust. I have a Windows 10 machine connected to the Samba4 domain. When I attempt to logon with an account from the IPA domain I am presented with "Insufficient system resources exist to complete the requested service." At first I took this message at face value and increased the memory of the workstation from which I'm trying to logon. There are few results from a Google search about this error without focusing on local memory. After reading and troubleshooting I believe this is a failure may be in the Kerberos InitializeSecurityContext function that's producing SEC_E_INSUFFICIENT_MEMORY, specifically on the Windows workstation and seemingly not coming from Samba4 AD. A couple things I've noticed; when I attempt to login as user@ipa if the password is wrong Windows tell me my password is incorrect. If I use the correct password I'm presented with that "Insufficient system resources exist to complete the requested service." The Event Viewer only shows me a generic logon error message. When I look at the Kerberos logs on both systems I see on AD that the 'Realm not local to KDC' and a 'No matching key in entry' but on IPA I see 'Additional pre-authentication required', then AS_REQ ISSUE and finally TGS_REQ ISSUE. I continued to do a tcpdump on port 88 to see who was directly communicating to the FreeIPA server and I found that the Windows workstation was making a direct Kerberos request. I then expanded my tcpdump to include all traffic from the workstation and upon another logon attempt only port 88 was used to communicate to FreeIPA. I therefore think that this is a Kerberos specific problem and not necessarily a Samba4 problem. Unfortunately I'm not knowledgeable enough in Kerberos to identify what's going on. I don't know what information I should present, such as configs or logs. Whatever is needed I can provide. I greatly appreciate any help, advice or potentially other non management nightmare solutions! Thank you all very much! [root@freeipa-dev log]# ipa trustdomain-find ad.school.edu Domain name: ad.school.edu Domain NetBIOS name: AD Domain Security Identifier: S-1-5-21-276971437-2632767696-819257926 Domain enabled: True ---------------------------- Number of entries returned 1 ---------------------------- -- Vex

3 3

AD Trust Integration Issue
by Henry Pelke 18 Apr '19

18 Apr '19

Good morning, I have recently setup an environment with FreeIPA 4.6.4-10 using CentOS 7 as the IPA Master. After setting up I joined the IPA master to the local AD and everything seemed to work fine. The issue I'm facing is that after adding the external and POSIX group's I can authenticate to the IPA Master as an AD user but the server with the IPA client doesn't appear to be able to authenticate AD users. The client server is unable to run getent or kinit against any ad user and returns 'Cannot find KDC for realm "<ad domain>"...' From the krb5kdc log I can see what looks to be an issue with the TGS request, and the errors TGS_REQ ISSUE: authtime as well as AS_REQ: NEEDED_PREAUTH additional preauth required. I have enabled debug logs for SSSD but nothing except sigterms has been logged so far. Please let me know if I can send any logs. Kind regards, HP

3 2

Directory manager password best practices
by Ian Pilcher 17 Apr '19

17 Apr '19

I am setting up a new IPA instance to provide DNS and CA services in a team lab. I have to decide what to use for the Directory Manager password — our standard, not very secure root password or something else, which no one will ever remember. Any thoughts? Is it still a major project to change the DM password? How hard is it to recover/reset it these days? (This will be IPA 4.6 on RHEL 7.) Thanks!

2 5

Password expired
by mustafa taha 17 Apr '19

17 Apr '19

Hi i want to ask , if there a way allows the admin to provide an account with password expired after certain of time. and after a certain time the password will not valid . i see there is field named " Password expiration" , how can i control it for specified user ?

4 3

Best practice backuping freeipa in docker
by Petar Kozić 17 Apr '19

17 Apr '19

Hi folks. I’m using freeipa in docker on one VM machine and for now, I satisfied how that works, but I worried about backup. Can someone tell me what is best practice for backup ipa which works in docker? Do I need to use backup scripts or some different method? Thank you in advance. *—* *Petar Kozić*

2 4

User's primary group set to recently deleted user group
by Devin Roark 16 Apr '19

16 Apr '19

Hello, I have inherited a freeipa cluster and during a cleanup of groups. We discovered one of the groups that was deleted was set as a couple user's primary gid in the past, which I'm assuming was a manual process because it looks like the default behavior is the standard groupname/gid matching the username/uid in FreeIPA. This causes errors when on enrolled hosts, bash runs the id command behind the scenes and subsequently breaks some automated pipelines for these users. Although doing an `ipa group-find --gid=${CORRESPONDING_UID}` doesn't return any groups but users still match uid's and gid's, my thinking is if we modify these two users to use their UID's as their primary group again the issues will be resolved. My question is will this have any known unintended consequences? Thanks, Devin

2 2

How to move FreeIPA to new server?
by fujisan 16 Apr '19

16 Apr '19

Hello, I just got a new server on which I'd like to install a FreeIPA server. Today it is installed on the old server. I just tried to install it with ipa-server-install but of course it complained saying the DNS domain is handled by the old server. What is the best way to install FreeIPA on the new server without disturbing the users too much? Regards, F.

3 6

ID-View for AD group to use GECOS umask
by Ronald Wimmer 16 Apr '19

16 Apr '19

Afaik it should be possible to set a users umask by putting something like "umask=0007" in the GECOS field in combination with pam_umask.so. pam_umask.so seems to be present on our systems. What I do not know is in which file (at which exact position) I would have to put "session optional pam_umask.so". Should it work in general or would pam_umask.so only respect the GECOS field of local users? Cheers, Ronald

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2019