FreeIPA-users July 2019

freeipa-users@lists.fedorahosted.org

56 participants
85 discussions

How to extract the SSL key and certificate used by FreeIPA on it's HTTPS interface?
by Chris Dagdigian 02 Jul '19

02 Jul '19

Got a strange one for the list ... I've got a lovely multi-region replicating FreeIPA cluster spanning a few AWS VPCs that is doing a fantastic job stitching together a complex Active Directory topology Now, however I have a need to support clients in a different, less trusted VPC and the firewall people want to do a MiTM attack on the TLS/HTTPS streams so they can intercept, decrypt and monitor HTTPS traffic -- including apparently to and from the IPA nodes. They want the SSL cert and key used by the HTTPS interface on the IPA systems so they can set up the intercept properly. My main question -- how do I properly extract the key and certificate from FreeIPA? From reading and poking around it looks like the certs I want are in /etc/httpd/alias but must be access by the 'certutil' utility which seems .. under documented ... both in the IPA docs as well as from what I can tell online. I'm sort of terrified of breaking my installation by screwing up certificate work. Can anyone provide tips, URLs or a cheatsheet for pulling SSL certificates and keys out of FreeIPA? Particularly the cert and key that is used on the HTTPS TCP:443 interface? Thanks! Chris

2 1

IdM + AD - restrict KDC servers for login
by Jean Figarella 02 Jul '19

02 Jul '19

Hello all, In a IdM + AD trust setup; has anyone ever had the need to restrict IPA client logins to a specific Active Directory server when using their AD credentials? The problem I am having is that the one of my clients has a AD cluster and some of the kdc servers in that cluster have clocks that are not synchronized. Whenever someone tries to log in using their AD account, if they hit a un-synchronized server then they get hit with the "kinit: clock skew too great ..." error. Since we don't control the AD server and since they refused to fix their time sync issues, I have been trying to restrict AD logins to a specific kdc server, but have been unable to do it. I have tried to edit the sssd.conf and krb5.conf configuration files, but nothing seems to work. Any suggestions? Thanks Jean Figarella

3 2

Fedora 30 Client
by Christian Reiss 02 Jul '19

02 Jul '19

Hey folks, after testing servers, replications et all (all with awesome success) I am getting to test with clients. Everything is working except Fedora 30 (Workstation, not Server). I can do the usual ipa-client-install dance, which will create the kerberos information. I can get a kerberos ticket using kinit as well as logging in from a remote host to this one. However, it is not possible to do a local (gdm) login with valid IPA account. Neither with "Other User" nor via normal Linux Console (tty*). sudo denies everything but the local login. Hint: I am trying to login into the machine that has an existing user account. Wait, what? [ 10 Minutes later ] I created a new user in IPA and logged in from that one. Worked like magic. So no non-existent users. So assuming that there might be some users that might have accounts (read: all and everyone) -- what's the smartest way to mitigate or migrate? Thanks! -Chris. -- Christian Reiss - email(a)christian-reiss.de /"\ ASCII Ribbon support(a)alpha-labs.net \ / Campaign X against HTML WEB alpha-labs.net / \ in eMails GPG Retrieval https://gpg.christian-reiss.de GPG ID ABCD43C5, 0x44E29126ABCD43C5 GPG fingerprint = 9549 F537 2596 86BA 733C A4ED 44E2 9126 ABCD 43C5 "It's better to reign in hell than to serve in heaven.", John Milton, Paradise lost.

2 2

Replication-install Tomcat error stage 1:/28 / Need help
by Karim Bourenane 01 Jul '19

01 Jul '19

Hello All I have follow the step from stepes from Freeipa web + Redhat to prepare the replicat by commands : DNS+Reverse : OK On IPA Master : ipa-replica-prepare --password=XXXXX replicat.example.com Scp the Gpg file from the Master to slave/replicat as root to /var/lib/ipa On IPA Replicat : ipa-replica-install --password=XXXXX /var/lib/ipa/replica-fil.gpg --setup-kra --setup-ca --setup-dns --no-forwarders After several secondes, the installation stop on stage : [1/28] Configuring centificat server instaance The first ERROR line: ipaserver.install.dogtaginstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispanw -s CA -f /tmp/tmMg7KE' returned non-zero exist statut 1 The second ERROR line: ipaserver.install.dogtaginstance: CRITICAL See installation.... The third ERROR line : ipaserver.install.dogtaginstance:CRITICAL [error] RuntimeError: CA configuration failed. My IPA Master was in Centos 7.3 IPA:v4.5.0 The replica server in Centos 7.6 IPA:v4.6.4 Can you help to resolve this pb ? Regards Mr Karim Bourenane

3 2

Re: IPA Client failed login after screen lock
by Boyd Ako 01 Jul '19

01 Jul '19

Yeah, adding the KDC cert didn't help. At this point managers are down the throat on getting it going whatever. Is there a way to migrate from using the external CA for everything except HTTP to setting it up as an IPA CA? Or I gotta rebuild the IPA stuff from scratch? ------------------------------ Thank you for your time, Boyd H. Ako boyd.hanalei.ako(a)gmail.com https://www.boydhanaleiako.me PGP/GPG Public Key: https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134 ------------------------------ On Thu, Jun 27, 2019 at 10:57 PM Sumit Bose <sbose(a)redhat.com> wrote: > On Wed, Jun 26, 2019 at 04:14:27PM -1000, Boyd Ako wrote: > > Thanks for all the help! > > > > But, still nothing after uncommenting the pki anchors line. I added the > > same tar ball with the configs and logs. Also threw in a tail snippet I > had > > running when trying to login. > > Hi, > > it looks like PKINIT is currently not configured completely on the > IPA server. I added a couple of options how to move forward to the case. > > bye, > Sumit > > > > > > > > > ------------------------------ > > Thank you for your time, > > > > Boyd H. Ako > > > > boyd.hanalei.ako(a)gmail.com > > https://www.boydhanaleiako.me > > > > PGP/GPG Public Key: > > https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134 > > ------------------------------ > > > > > > On Tue, Jun 25, 2019 at 11:45 PM Sumit Bose <sbose(a)redhat.com> wrote: > > > > > On Tue, Jun 25, 2019 at 04:33:10PM -1000, Boyd Ako wrote: > > > > I did the kerberos cert change as stated and it's still the same. > > > > > > Hi, > > > > > > I added a new comment to the case, I think we are near a solution. > > > > > > bye, > > > Sumit > > > > > > > > > > > > > > > > > > > ------------------------------ > > > > Thank you for your time, > > > > > > > > Boyd H. Ako > > > > > > > > boyd.hanalei.ako(a)gmail.com > > > > https://www.boydhanaleiako.me > > > > > > > > PGP/GPG Public Key: > > > > > https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134 > > > > ------------------------------ > > > > > > > > > > > > On Mon, Jun 24, 2019 at 10:06 PM Sumit Bose <sbose(a)redhat.com> > wrote: > > > > > > > > > On Fri, Jun 21, 2019 at 01:04:32PM +0200, Sumit Bose wrote: > > > > > > On Thu, Jun 20, 2019 at 11:28:54PM -1000, Boyd Ako wrote: > > > > > > > CASE 02390764 > > > > > > > > > > > > Hi, > > > > > > > > > > > > I have added a comment to the case to keep support in the loop as > > > well. > > > > > > > > > > > > Please let's continue in the case. > > > > > > > > > > Hi, > > > > > > > > > > sorry for the delay but I didn't had a chance to check the logs > > > > > yesterday. I added a new comment to the case. > > > > > > > > > > bye, > > > > > Sumit > > > > > > > > > > > > > > > > > bye, > > > > > > Sumit > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > On Jun 20, 2019, at 22:30, Sumit Bose via FreeIPA-users < > > > > > freeipa-users(a)lists.fedorahosted.org> wrote: > > > > > > > > > > > > > > > > On Fri, Jun 21, 2019 at 01:14:33AM -0000, Boyd Ako via > > > FreeIPA-users > > > > > wrote: > > > > > > > >> So, I created a Red Hat ticket to assist and the support is > > > pretty > > > > > non-productive. > > > > > > > >> > > > > > > > >> I have a RHEL 7 "Workstation" setup as an IPA client that > most > > > of > > > > > the time works. However, there are occasions when the screen locks > out > > > due > > > > > to inactivity that I can't log back in. Most of the time it occurs > > > when I > > > > > use smartcard x.509 to login; but it also occasionally happens I > use > > > > > password to login intially. It's not very consistent on the > failures. > > > The > > > > > only way to login AFTER that is to annoyingly reboot or console in > as > > > root > > > > > and start a kerberos session. > > > > > > > >> > > > > > > > >> The IPA server is using an external CA. On the client, the > CA > > > certs > > > > > on the smartcard are in /etc/pki/nssdb. The chain is Root CA -> ID > > > > > Intermediate CA -> x.509 cert on token. All the CA's are external. > The > > > > > token cert did validate when using the Root Ca and ID CA certs > tacked > > > > > together for the CAfile in `openssl verify`. I added the following > to > > > the > > > > > sssd.conf: > > > > > > > >> > > > > > > > >> =============================== > > > > > > > >> [domain/mydomain.com] > > > > > > > >> debug_level = 8 > > > > > > > >> account_cache_expiration = 5 > > > > > > > >> entry_cache_timeout = 28800 > > > > > > > >> > > > > > > > >> [pam] > > > > > > > >> debug_level = 8 > > > > > > > >> offline_credentials_expiration = 5 > > > > > > > >> =============================== > > > > > > > > > > > > > > > > Hi, > > > > > > > > > > > > > > > > did you add logs with debug_level=8 to the case you have > > > mentioned? > > > > > If > > > > > > > > yes, please let me know the case number so that I can have a > > > look. If > > > > > > > > not, please send the logs. If you prefer to not share them on > > > this > > > > > list > > > > > > > > feel free to send them to me directly. > > > > > > > > > > > > > > > > bye, > > > > > > > > Sumit > > > > > > > > > > > > > > > >> > > > > > > > >> "pam_cert_auth = True" is in the PAM sect. I did run the > script > > > > > from the `ipa-advise` client-smart_card_script. > > > > > > > >> _______________________________________________ > > > > > > > >> FreeIPA-users mailing list -- > > > freeipa-users(a)lists.fedorahosted.org > > > > > > > >> To unsubscribe send an email to > > > > > freeipa-users-leave(a)lists.fedorahosted.org > > > > > > > >> Fedora Code of Conduct: > > > > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > > > > > > > >> List Guidelines: > > > > > https://fedoraproject.org/wiki/Mailing_list_guidelines > > > > > > > >> List Archives: > > > > > > > > > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > > > > > > > _______________________________________________ > > > > > > > > FreeIPA-users mailing list -- > > > freeipa-users(a)lists.fedorahosted.org > > > > > > > > To unsubscribe send an email to > > > > > freeipa-users-leave(a)lists.fedorahosted.org > > > > > > > > Fedora Code of Conduct: > > > > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > > > > > > > > List Guidelines: > > > > > https://fedoraproject.org/wiki/Mailing_list_guidelines > > > > > > > > List Archives: > > > > > > > > > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > > > > > > > > > > > > > > > > > > > > > > > > > > > Domo, > > > > > > > > > > > > > > Boyd H. Ako > > > > > > > > > > > > > > > > > > > > > boyd.hanalei.ako(a)gmail.com > > > > > > > (424) 244-9653 > > > > > > > https://www.boydhanaleiako.me > > > > > > > > > > > > > > “Coming together is a beginning. Keeping together is progress. > > > Working > > > > > together is success.” -Henry Ford > > > > > > > > > > > > > > PGP/GPG Public Key: > > > > > > https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134 > > > > > > > > > > > > > > > > > > > > > > > > > > > >

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2019