FreeIPA-users February 2022

freeipa-users@lists.fedorahosted.org

54 participants
93 discussions

Use of OTP in special cases?
by Michael Schwartzkopff 20 Feb '22

20 Feb '22

Hi, I am testing OTP usage of FreeIPA. really cool stuff. Thanks for you work. I have a user with "authentication type: OTP". So every time he wants to log in he is asked for username and token. Works. Sometimes it should be sufficient to provide only password, not OTP (i.e. inside company with company laptop). OTP should only be asked in special cases like VPN access. Is this possible? Mit freundlichen Grüßen, -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

3 5

pcks11-bind with DDNS updates from ISC DHCP returns SERVFAIL frequently
by Brian J. Murrell 20 Feb '22

20 Feb '22

Is anyone here running FreeIPA on EL8 (a.k.a. RedHat IdM) with DDNS updates enabled from dhcpd, and running that server as their network's recursive resolver? Successfully? On EL7, this just didn't work for me due to https://bugzilla.redhat.com/show_bug.cgi?id=1409321 and it seems even worse on EL8. The TL;DR: is that if you have DDNS updates coming named-pkcs11 from ISC dhcpd, many (i.e. recursive resolver) queries to named-pkcs11 will frequently, temporarily and intermittently return SERVFAIL. If you stop the DDNS updates from ISC DHCP the recursive resolving behaviour of the server stabilizes and it stops returning SERVFAILs. So, this is just a query to see if anyone is actually running this configuration successfully. If you think you might be successful with this configuration, how many recursive resolvers do you have in your network? If you have more than just the (single) FreeIPA server, it might be that named-pkcs11 on that machine is frequently returning SERVFAIL and that you are just not noticing because your alternate recursive resolvers are masking it. So if you are running in such a configuration with alternate recursive resolvers, it might be interesting to use tcpdump or some such on your FreeIPA server to see if your named-pkcs11 is indeed returning SERVFAIL for many of your queries. Cheers, b.

2 1

freeipa and pihole integration, so no forwarders
by Rob Verduijn 18 Feb '22

18 Feb '22

Hi all, I'm trying to reduce the number of systems in my network. Currently if I want to use a pi-hole in combination with freeipa one of them is going to use the other as a forwarder. And without some firewall/router port redirection magic (also hopelessly complicating things) this is not going to run on one system. Did anybody manage to integrate pi-hole into freeipa as a plugin or some other nifty solution making it possible to run it all on one system ? Rob

2 3

Ubuntu 20.04 as a client - no A records
by lejeczek 17 Feb '22

17 Feb '22

Hi guys would anybody be able to confirm that Ubuntu client does not get IPA to create A record unless '--ip-address' is used with the client? I do not suppose it's IPA server's issue, right? many thanks, L.

1 0

Freeipa and server SFTP
by MERCIER Jonathan 16 Feb '22

16 Feb '22

Dear Dev team and community, I created a PAM file in order to authenticate user through vstpd service I would like to get your recommendation Thanks for your insight -------------------------------------- #%PAM-1.0 auth sufficient pam_sss.so forward_pass auth required pam_env.so auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed auth required pam_shells.so auth include password-auth account [default=bad success=ok user_unknown=ignore authinfo_unavail=ignore] pam_sss.so account include password-auth session required pam_loginuid.so session optional pam_keyinit.so force revoke session required pam_mkhomedir.so umask=0022 session required pam_loginuid.so session include password-auth

1 0

renew op produces cert with CN=localhost
by Leo Galambos 16 Feb '22

16 Feb '22

Hello, our FreeIPA was running with correct certificates for 2 years (subject "CN=ipa.hq.company,O=HQ.COMPANY"). Unfortunately, the new certificates (ocspSigningCert, auditSigningCert) were recreated with simple "CN=localhost" (automatically), i.e. the original value "CN=ipa.hq.company,O=HQ.COMPANY" was ignored by certmonger. If you have some knowledge of the FreeIPA internals - can you point me to the right direction, so that I could debug and/or fix this rotation bug, please? Thank you, LG certmonger-0.79.13-3.el8.x86_64 ipa-server-4.9.6-10.module+el8.5.0+13587+92118e57.x86_64 # getcert list Request ID '20200324213127': status: MONITORING stuck: no : CA: IPA issuer: CN=Certificate Authority,O=HQ.COMPANY subject: CN=ipa.hq.company,O=HQ.COMPANY expires: 2022-03-25 22:31:28 CET principal name: krbtgt/HQ.COMPANY(a)HQ.COMPANY key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes Request ID '20210120221127': status: MONITORING stuck: no : CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=HQ.COMPANY subject: CN=localhost expires: 2024-02-04 22:29:37 CET key usage: digitalSignature,nonRepudiation profile: caSignedLogCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20210120221129': status: MONITORING stuck: no : CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=HQ.COMPANY subject: CN=localhost expires: 2024-02-04 22:28:36 CET eku: id-kp-OCSPSigning profile: caOCSPCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes <snip>

2 4

No memberof attribute for external users
by Ruslan Valikhanov 16 Feb '22

16 Feb '22

I cannot get memberof attribute for external users from one-way trust with AD. I have an external group ad_grafana_external with users adtest(a)adtest.local and adtest2(a)adtest.local from AD. This group is a member of group ad_grafana: ldapsearch -W -D "uid=admin,cn=users,cn=accounts,dc=mytest,dc=local" '(cn=ad_grafana)' | grep member member: cn=ad_grafana_external,cn=groups,cn=accounts,dc=mytest,dc=local I can see that AD users are members of ad_grafana group: getent group ad_grafana ad_grafana:*:105800310:adtest2@adtest.local,adtest@adtest.local But I cannot get memberof attribute for this external users: # ldapsearch -W -D "uid=admin,cn=users,cn=accounts,dc=mytest,dc=local" '(uid=adtest2(a)adtest.local)' # extended LDIF # # LDAPv3 # base <dc=mytest,dc=local> (default) with scope subtree # filter: (uid=adtest2(a)adtest.local) # requesting: ALL # # adtest2(a)adtest.local, users, compat, m.mcs.im dn: uid=adtest2(a)adtest.local,cn=users,cn=compat,dc=mytest,dc=local objectClass: posixAccount objectClass: ipaOverrideTarget objectClass: top gecos: adtest2 adtest2 cn: adtest2 adtest2 uidNumber: 140601109 gidNumber: 140601109 homeDirectory: /home/adtest.local/adtest2 ipaAnchorUUID:: OlNJRDpTLTEtNS0yMS0yNjExMDg4Ny0yODU2MDIzNTY0LTI5MTIyOTUzNjYtMT EwOQ== uid: adtest2(a)adtest.local # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Is it possible to add memberof attrubutes to external users? This is needed to authenticate them in web applications such as Grafana and Gitlab in my case. FreeIPA version: 4.6.8-5 OS: CentOS Linux release 7.7.1908 (Core)

2 1

Re: ipa with duo
by John Desantis 14 Feb '22

14 Feb '22

Charles, > Our campus uses DUO. We're wondering whether it's possible to use that from IPA. My main concern is that user interaction can take time. Yes, it is possible and we currently utilize DUO on restricted systems. Our IPA domain consists of an AD Trust (bulk of users) and IDM-only users. HTH, John DeSantis Il giorno ven 11 feb 2022 alle ore 12:40 Charles Hedrick via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> ha scritto: > > Our campus uses DUO. We're wondering whether it's possible to use that from IPA. My main concern is that user interaction can take time. > > I see that it's possible to raise the timeout. But is that safe to do? I'm wondering whether otpd is really designed to have lots of threads waiting for the user to respond. > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

1 0

FreeIPA and AIX
by Ronald Wimmer 14 Feb '22

14 Feb '22

I was wondering if one can configure AIX in a way that trusted AD domain users can be used to log in under AIX. We followed https://www.freeipa.org/page/ConfiguringUnixClients but this guide seems to be LDAP-only and AD users do not have a represenntation in FreeIPA's LDAP directory. Could someone please clarify if AD users could work or not? Cheers, Ronald

3 2

How to disallow ldap query without authentication ?
by MERCIER Jonathan 14 Feb '22

14 Feb '22

Dear FreeIPA community and Dev Team, We have installed some month ago freeipa throw ansible collection/role, and I see that we can query the LDAP to get registered user. For us it is a medium issue, I would like to know, how to allow LDAP query only through an authentication. Did you have a wiki or a documentation for this ? Thanks a lot Best regards

3 4

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2022