FreeIPA-users January 2022

freeipa-users@lists.fedorahosted.org

48 participants
94 discussions

2FA - prompting - single_prompt
by Winfried de Heiden 03 Jan '22

03 Jan '22

Hi all, Using FreeIPA, 2FA can be made optional by enabling "Password" AND "Two factor authentication (password + OTP)" for a user. For particular hosts the 2FA now can be made mandatory by enabling "Two factor authentication (password + OTP)" Now, for hosts for which 2FA is NOT mandatory, according to the man pages, 2FA can be made "invissible" by using the "single_prompt" option. In man sssd.conf: "If the second factor is optional and it should be possible to log in either only with the password or with both factors two-step prompting has to be used." However, this doesn't work. When using the "single_prompt" login will fail. Using two prompts, and just press enter for the second 2FA prompt, login will succeed. Hence: did I forget something or is there a bug involved? FYI: tested on CentOS Stream9 -- email handtekening privé Met vriendelijke groet, Winfried de Heiden wdh(a)dds.nl

2 1

ipa-ca-install rejects confirmed correct DM password
by Chris Candreva 03 Jan '22

03 Jan '22

My problem is what the subject says. Most of the searches I've found are what to do when you don't know the Directory Manager password. However I can confirm it is correct with ldapsearch, yet ipa-ca-install says it is wrong. I'd appreciate any hints as to where to look next. [root@ipa3 chris]# export DMP=<pasword> [root@ipa3 chris]# ldapsearch -x -D "cn=directory manager" -w $DMP -s base -b "" "objectclass=*" | head # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: objectclass=* # requesting: ALL # # dn: [root@ipa3 chris]# ipa-ca-install --password=$DMP Directory Manager password is invalid -- --- ======================================================================== Chris Candreva -- chris(a)westnet.com -- http://www.westnet.com/~chris

2 1

Samba 4.10.16-17.el7_9 and IPA 4.6.8-5.el7.centos.10 updates broke SMB Kerberos authentication
by Konstantin M. Khankin 01 Jan '22

01 Jan '22

Hello! I have several SMB shares served by Samba using Kerberos accounts managed by FreeIPA. I have no AD integrations and no AD itself. Windows clients are configured using this <https://www.freeipa.org/page/Windows_authentication_against_FreeIPA> guide, linux clients use ipa-client and "smbclient -k". Servers and linux clients use CentOS 7. Today I received updates for ipa-* (to 4.6.8-5.el7.centos.*10* from 4.6.8-5.el7.centos.*9*) and samba-* (to 4.10.16-*17*.el7_9 from 4.10.16-*15*.el7_9) packages and authentication broke, no clients can connect to shares anymore. Here are logs from linux client: $ klist Ticket cache: KEYRING:persistent:1696200001:1696200001 Default principal: me(a)MYDOMAIN.LOC Valid starting Expires Service principal 12/30/2021 18:04:03 12/31/2021 18:03:46 cifs/samba.server.mydomain.loc(a)MYDOMAIN.LOC 12/30/2021 18:04:02 12/31/2021 18:03:46 nfs/samba.server.mydomain.loc(a)MYDOMAIN.LOC 12/30/2021 18:03:49 12/31/2021 18:03:46 krbtgt/MYDOMAIN.LOC(a)MYDOMAIN.LOC $ smbclient -k -L //samba.server.mydomain.loc session setup failed: NT_STATUS_NO_IMPERSONATION_TOKEN Server logs: *log.smbd:* [2021/12/30 19:03:23.597495, 2] ../../source3/lib/smbldap.c:847(smbldap_open_connection) smbldap_open_connection: connection opened [2021/12/30 19:03:23.695598, 3] ../../source3/lib/smbldap.c:1069(smbldap_connect_system) ldap_connect_system: successful connection to the LDAP server [2021/12/30 19:03:23.737401, 1] ipa_sam.c:4896(pdb_init_ipasam) pdb_init_ipasam: support for pdb_enum_upn_suffixes enabled for domain mydomain.loc [2021/12/30 19:03:23.737597, 3] ../../lib/util/access.c:365(allow_access) Allowed connection from 192.168.10.1 (192.168.10.1) *log.192.168.10.1:* ... [2021/12/30 19:05:22.458992, 3] ../../source3/smbd/negprot.c:776(reply_negprot) Selected protocol SMB 2.??? [2021/12/30 19:05:22.459495, 3] ../../source3/smbd/smb2_negprot.c:293(smbd_smb2_request_process_negprot) Selected protocol SMB3_11 [2021/12/30 19:05:22.524677, 3] ../../auth/kerberos/gssapi_pac.c:123(gssapi_obtain_pac_blob) gssapi_obtain_pac_blob: obtaining PAC via GSSAPI gss_get_name_attribute failed: The operation or option is not available or unsupported: No such file or directory [2021/12/30 19:05:22.524750, 1] ../../auth/gensec/gensec_util.c:70(gensec_generate_session_info_pac) gensec_generate_session_info_pac: Unable to find PAC in ticket from me(a)MYDOMAIN.LOC, failing to allow access [2021/12/30 19:05:22.524784, 3] ../../source3/smbd/smb2_server.c:3213(smbd_smb2_request_error_ex) smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] status[NT_STATUS_NO_IMPERSONATION_TOKEN] || at ../../source3/smbd/smb2_sesssetup.c:146 [2021/12/30 19:05:22.525565, 3] ../../source3/smbd/server_exit.c:236(exit_server_common) Server exit (NT_STATUS_END_OF_FILE) Googling, source-digging and "log level = 5" were not helpful. However, I find changelogs somewhat interesting: $ rpm -q --changelog ipa-server | head * Thu Dec 16 2021 CentOS Sources <bugs(a)centos.org> - 4.6.8-5.el7.centos.10 - Roll in CentOS Branding * Thu Dec 02 2021 Florence Blanc-Renaud <frenaud(a)redhat.com> - 4.6.8-5.el7_9.10 - Resolves: 2025848 - RHEL 8.6 IPA Replica Failed to configure PKINIT setup against a RHEL 7.9 IPA server - Fix cert_request for KDC cert - Resolves: 2021444 - CVE-2020-25719 ipa: samba: *Samba AD DC did not always rely on the SID and PAC in Kerberos tickets* - SMB: switch IPA domain controller role $ rpm -q --changelog samba | head * Mon Nov 15 2021 Andreas Schneider <asn(a)redhat.com> - 4.10.16-17 - related: #2019673 - *Add missing checks for IPA DC server role* * Mon Nov 08 2021 Andreas Schneider <asn(a)redhat.com> - 4.10.16-16 - resolves: #2019661 - Fix CVE-2016-2124 - resolves: #2019673 - Fix CVE-2020-25717 - resolves: #2021428 - *Add missing PAC buffer types to krb5pac.idl* I don't have access to the mentioned bugs in Bugzilla unfortunately. Maybe someone knows if I need to do something after upgrading these packages? Rolling back samba packages is unwanted given that Samba sources mention this is unsafe. Thanks! -- Konstantin Khankin

2 5

Re: FreeIPA missing replication segments but still replicating
by Florence Blanc-Renaud 01 Jan '22

01 Jan '22

Hi, do you have a kerberos ticket for the "admin" user when the "ipa topologysuffix-show" command (or any other ipa command) is called? Some commands require admin privileges to access the data, and will not display anything if they are executed without an admin ticket. Please try with "kinit admin; ipa topologysuffix-show" and let us know if it solves the problem. flo On Thu, Dec 30, 2021 at 2:29 PM Neal Harrington via FreeIPA-users < freeipa-users(a)lists.fedorahosted.org> wrote: > Hi, > > I have managed to setup an IPA cluster which is still replicating changes > to users and CA's, but thinks it has no replication configured. I'm not > sure how I have managed this and have not been able to figure it out so > would appreciate any pointers anyone can provide. > > I setup an initial IPA server, successfully joined a further 5 and setup > the replication using the web based GUI with 3 being domain+ca and the > remaining 3 being just domain. All seemed good, a user created on one > server appeared on remote IPA servers and I left for Christmas. > > Returning for work yesterday and the web based GUI does not show any links > between the servers and will not let me add any with error "leftnode does > not support suffix 'domain'". However if I create or edit a user then it > appears on the other IPA servers and adding a new root CA also is visible > from all IPA servers. I can also successfully join client servers, and then > login to them with IPA based credentials. > > The "ipa topology*" commands show no suffixes or segments, however an LDAP > search does show the links as I set them up (output below). The only errors > I have seen in the logs are for things which google searches list as > "normal" - but I'm obviously missing something. Disabling firewall/selinux > does not seem to have any impact and DNS/reverse DNS is resolving correctly > from all the servers. The only difference to the guides is that FreeIPA is > not hosting the reverse zones itself - I'm using forwarders to my main DNS > servers which host those records - but I can't see that being related as > resolution is working. > > Any pointers for where to look and what to look for next greatly > appreciated. This is a fresh deploy, so I can wipe and restart if needed, > but I'd like to at least understand what is going on so I can avoid > repeating it in the future. > > versions installed : > ipa-client-4.9.6-10.module+el8.5.0+719+4f06efb6.x86_64 > ipa-server-4.9.6-10.module+el8.5.0+719+4f06efb6.x86_64 > ipa-server-dns-4.9.6-10.module+el8.5.0+719+4f06efb6.noarch > > # ipa topologysuffix-show > Suffix name: domain > ipa: ERROR: domain: suffix not found > # ipa topologysuffix-find --all > --------------------------- > 0 topology suffixes matched > --------------------------- > ---------------------------- > Number of entries returned 0 > ---------------------------- > # ipa topologysegment-find domain --all > ------------------ > 0 segments matched > ------------------ > ---------------------------- > Number of entries returned 0 > ---------------------------- > > > > $ ldapsearch -D "cn=directory manager" -W -b > "cn=topology,cn=ipa,cn=etc,dc=ipa,dc=mydomain,dc=net" > Enter LDAP Password: > # extended LDIF > # > # LDAPv3 > # base <cn=topology,cn=ipa,cn=etc,dc=ipa,dc=mydomain,dc=net> with scope > subtree > # filter: (objectclass=*) > # requesting: ALL > # > > # topology, ipa, etc, ipa.mydomain.net > dn: cn=topology,cn=ipa,cn=etc,dc=ipa,dc=mydomain,dc=net > objectClass: top > objectClass: nsContainer > cn: topology > > # domain, topology, ipa, etc, ipa.mydomain.net > dn: cn=domain,cn=topology,cn=ipa,cn=etc,dc=ipa,dc=mydomain,dc=net > objectClass: top > objectClass: iparepltopoconf > ipaReplTopoConfRoot: dc=ipa,dc=mydomain,dc=net > nsDS5ReplicatedAttributeList: (objectclass=*) $ EXCLUDE memberof > idnssoaserial > entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount > nsDS5ReplicatedAttributeListTotal: (objectclass=*) $ EXCLUDE entryusn > krblasts > uccessfulauth krblastfailedauth krbloginfailedcount > nsds5ReplicaStripAttrs: modifiersName modifyTimestamp > internalModifiersName in > ternalModifyTimestamp > cn: domain > > # ca, topology, ipa, etc, ipa.mydomain.net > dn: cn=ca,cn=topology,cn=ipa,cn=etc,dc=ipa,dc=mydomain,dc=net > objectClass: top > objectClass: iparepltopoconf > ipaReplTopoConfRoot: o=ipaca > cn: ca > > # ipa1-c.ipa.mydomain.net-to-ipa2-c.ipa.mydomain.net, domain, topology, > ipa, et > c, ipa.mydomain.net > dn: cn=ipa1-c.ipa.mydomain.net-to-ipa2-c.ipa.mydomain.net > ,cn=domain,cn=topolog > y,cn=ipa,cn=etc,dc=ipa,dc=mydomain,dc=net > ipaReplTopoSegmentDirection: both > objectClass: iparepltoposegment > objectClass: top > cn: ipa1-c.ipa.mydomain.net-to-ipa2-c.ipa.mydomain.net > ipaReplTopoSegmentLeftNode: ipa1-c.ipa.mydomain.net > ipaReplTopoSegmentRightNode: ipa2-c.ipa.mydomain.net > ipaReplTopoSegmentStatus: autogen > > # ipa1-c.ipa.mydomain.net-to-ipa1-b.ipa.mydomain.net, domain, topology, > ipa, et > c, ipa.mydomain.net > dn: cn=ipa1-c.ipa.mydomain.net-to-ipa1-b.ipa.mydomain.net > ,cn=domain,cn=topolog > y,cn=ipa,cn=etc,dc=ipa,dc=mydomain,dc=net > ipaReplTopoSegmentDirection: both > objectClass: iparepltoposegment > objectClass: top > cn: ipa1-c.ipa.mydomain.net-to-ipa1-b.ipa.mydomain.net > ipaReplTopoSegmentLeftNode: ipa1-c.ipa.mydomain.net > ipaReplTopoSegmentRightNode: ipa1-b.ipa.mydomain.net > ipaReplTopoSegmentStatus: autogen > > # ipa1-c.ipa.mydomain.net-to-ipa1-b.ipa.mydomain.net, ca, topology, ipa, > etc, i > pa.mydomain.net > dn: cn=ipa1-c.ipa.mydomain.net-to-ipa1-b.ipa.mydomain.net > ,cn=ca,cn=topology,cn > =ipa,cn=etc,dc=ipa,dc=mydomain,dc=net > ipaReplTopoSegmentDirection: both > objectClass: iparepltoposegment > objectClass: top > cn: ipa1-c.ipa.mydomain.net-to-ipa1-b.ipa.mydomain.net > ipaReplTopoSegmentLeftNode: ipa1-c.ipa.mydomain.net > ipaReplTopoSegmentRightNode: ipa1-b.ipa.mydomain.net > ipaReplTopoSegmentStatus: autogen > > # ipa2-c.ipa.mydomain.net-to-ipa2-b.ipa.mydomain.net, domain, topology, > ipa, et > c, ipa.mydomain.net > dn: cn=ipa2-c.ipa.mydomain.net-to-ipa2-b.ipa.mydomain.net > ,cn=domain,cn=topolog > y,cn=ipa,cn=etc,dc=ipa,dc=mydomain,dc=net > ipaReplTopoSegmentDirection: both > objectClass: iparepltoposegment > objectClass: top > cn: ipa2-c.ipa.mydomain.net-to-ipa2-b.ipa.mydomain.net > ipaReplTopoSegmentLeftNode: ipa2-c.ipa.mydomain.net > ipaReplTopoSegmentRightNode: ipa2-b.ipa.mydomain.net > ipaReplTopoSegmentStatus: autogen > > # ipa1-b.ipa.mydomain.net-to-ipa2-b.ipa.mydomain.net, domain, topology, > ipa, et > c, ipa.mydomain.net > dn: cn=ipa1-b.ipa.mydomain.net-to-ipa2-b.ipa.mydomain.net > ,cn=domain,cn=topolog > y,cn=ipa,cn=etc,dc=ipa,dc=mydomain,dc=net > ipaReplTopoSegmentLeftNode: ipa1-b.ipa.mydomain.net > ipaReplTopoSegmentRightNode: ipa2-b.ipa.mydomain.net > ipaReplTopoSegmentDirection: both > cn: ipa1-b.ipa.mydomain.net-to-ipa2-b.ipa.mydomain.net > objectClass: iparepltoposegment > objectClass: top > > # ipa1-c.ipa.mydomain.net-to-ipa1-a.ipa.mydomain.net, domain, topology, > ipa, et > c, ipa.mydomain.net > dn: cn=ipa1-c.ipa.mydomain.net-to-ipa1-a.ipa.mydomain.net > ,cn=domain,cn=topolog > y,cn=ipa,cn=etc,dc=ipa,dc=mydomain,dc=net > ipaReplTopoSegmentDirection: both > objectClass: iparepltoposegment > objectClass: top > cn: ipa1-c.ipa.mydomain.net-to-ipa1-a.ipa.mydomain.net > ipaReplTopoSegmentLeftNode: ipa1-c.ipa.mydomain.net > ipaReplTopoSegmentRightNode: ipa1-a.ipa.mydomain.net > ipaReplTopoSegmentStatus: autogen > > <SNIP several more links> > > # search result > search: 2 > result: 0 Success > > # numResponses: 17 > # numEntries: 16 > Follow us: > [image: Follow MyPhones on Facebook] <https://www.facebook.com/MyPhones17> > [image: Follow MyPhones on LinkedIn] > <https://www.linkedin.com/company/12015109> > [image: Follow MyPhones on Twitter] <https://twitter.com/MyPhones17> > Neal Harrington | System Administrator > Direct ‑ *01256831040* <01256831040> | Mobile ‑ *07849089832* > <07849089832> > Office* - 01494410000 | * <01494410000> *https://www.myphones.com* > <https://www.myphones.com/> > > > *** Please consider your environmental responsibility before printing this e‑mail *** > > MyPhones.com is the trading name of Et Al Innovations Limited, registered in the United Kingdom. > Company Number: 03718039 | VAT Registration Number: GB 697877637 > Registered Address: Glebe Farm, Down Street, Dummer, Basingstoke RG25 2AD > > > This message and any files transmitted with it is intended for the addressee only and may contain information that is confidential and/or legally privileged. > > Unauthorised use is strictly prohibited and may be unlawful. If you are not the addressee, you should not read, copy, disclose or otherwise use this message, including any picture or graphic and any attachment, > > except for the purpose of delivery to the addressee. We make every effort to keep our network free from viruses. However, you do need to verify this e‑mail and any attachments to it to be virus free as we can > > take no responsibility for any computer virus which might be transferred by way of this e‑mail. > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > Do not reply to spam on the list, report it: > https://pagure.io/fedora-infrastructure >

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2022