FreeIPA-users April 2022

freeipa-users@lists.fedorahosted.org

42 participants
73 discussions

FreeIPA 4.9.9
by Antonio Torres 26 Apr '22

26 Apr '22

1 0

Thank You
by High Adventure 25 Apr '22

25 Apr '22

Your article was very good, and you have given very good information in this article. I regularly read all the articles on your Website https://e-signindia.com/ https://acciojob.com/ https://shukriyasongs.com/

1 0

Strategy to renew TGT - any thoughts?
by Francis Augusto Medeiros-Logeay 25 Apr '22

25 Apr '22

Hi, We have a few machines that joined a FreeIPA instance. We use NFSv4 + kerberos to mount home directories. However, if the user do not log on to the machine for more than 7 days, and he leaves a job executing and that writes to some file on his home directory, the cpu usage of the machine goes up to the sky and the machine gets almost unusable. Is there a good strategy to fetch new TGT's when near expiration? I know some users generate a key tab (or fetch them using ipa-getkeytab) to automate a kinit, but I wonder if we could come with a system-wide solution that doesn't lead to storing key tabs around. Any tips for that? Best, -- Francis Augusto Medeiros-Logeay Oslo, Norway

8 15

Re: Strategy to renew TGT - any thoughts?
by Francis Augusto Medeiros-Logeay 25 Apr '22

25 Apr '22

Thanks a lot, Charles. I gave a look into it, really neat! Best, --- Francis Augusto Medeiros-Logeay Oslo, Norway On 2022-04-24 14:51, Charles Hedrick via FreeIPA-users wrote: > See clhedrick/kerberos in github. The README identifies the various > things there. > > ------------------------- > > From: Francis Augusto Medeiros-Logeay <r_f(a)med-lo.eu> > Sent: Sunday, April 24, 2022 8:35 AM > To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Cc: Charles Hedrick <hedrick(a)rutgers.edu> > Subject: Re: [Freeipa-users] Re: Strategy to renew TGT - any thoughts? > > Hey Charles, > > Thanks a lot for what you just described - it gives me a lot to think > about. > > If you have th etime, could you describe how the pam module is called > from the cron job, and how the TGT is fetched for the users? I mean, if > it is a cron job, how the tgt is fetched without passwords? And how > does the kdc issues the ticket? > > This info would help me a lot! > > Best, > > Francis > > --- > Francis Augusto Medeiros-Logeay > Oslo, Norway > > On 2022-04-22 20:59, Charles Hedrick via FreeIPA-users wrote: > >> We have a script that renews all tickets that are still in use, and >> kills those that are not. The original version of this is a bit >> complex, but I now have a bash script in testing that seems >> reasonable. >> >> I agree that keytables are a bit of a risk. They work on any host, and >> root can steal them. Here's what we do instead: For cron jobs, a user >> registers that they want to run cron jobs on a specific host. There's >> a pam module that will get a TGT for them when a cron job starts. It >> talks to a daemon on the kdc that verifies that they authorized it to >> issue tickets for that host and returns a ticket. The tickets are >> locked to that IP address and are not forwardble (since we are only >> using them from NFS). >> >> None of this code is specific to Rutgers, but the script requires less >> infrastructure than the cron support. I have concerns about what we're >> doing for cron. I suspect the right solution is to use constrained >> delegation for NFS. I think that can be done with gssproxy. >> >> ------------------------- >> >> From: Francis Augusto Medeiros-Logeay via FreeIPA-users >> <freeipa-users(a)lists.fedorahosted.org> >> Sent: Friday, April 8, 2022 2:19 PM >> To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> >> Cc: Sam Morris <sam(a)robots.org.uk>; Alexander Bokovoy >> <abokovoy(a)redhat.com>; Francis Augusto Medeiros-Logeay <r_f(a)med-lo.eu> >> Subject: [Freeipa-users] Re: Strategy to renew TGT - any thoughts? >> >> On 2022-04-08 10:57, Alexander Bokovoy via FreeIPA-users wrote: >>> On pe, 08 huhti 2022, Francis Augusto Medeiros-Logeay via >>> FreeIPA-users >>> wrote: >> >>>> I've looked k5start before, and, correct me if I am wrong, but the >>>> difference between using a `kinit -k -i | -t keytab` and k5start is >>>> that the later takes care of the daemonization aspect, right? As I >>>> see >>>> it, both need a keytab to work. The issue for me here is that it is >>>> a >>>> bit undesirable to leave a keytab around. What I like about FreeIPA >>>> is >>>> that you can fetch the keytab from a cached credential, so that it >>>> you >>>> could fetch it, use k5start or kinit -kt, and then erase it. >>>> >>>> I guess there's no way to renew those tickets without a keytab, >>>> right? >>> >>> Nope -- unless you store that password somewhere and run a systemd >>> timer, effectively. >>> >>> If you store your user credentials into a keytab and just set >>> KRB5_CLIENT_KTNAME, this will work too. A systemd timer could be used >>> to >>> replace k5start. >>> >>> Alternatively, gssproxy could be used for that. It already knows how >>> to >>> handle NFS, for example, so it would work just fine. But it also >>> expects >>> to have a keytab in a proper place. >> >> Thanks a lot, Alexander. >> >> I am clueless now on how to solve this. We experienced that, on >> machines >> where the user uses nfsv4+kerberos to mount their home directory, what >> happens is that if the user has some job that writes to some file on >> his >> home directory, the machine goes bananas if the ticket expires (ie, if >> the user goes on vacation and doesn't log in). This is already a >> problem >> for a machine with one user, imagine when the machine has dozens of >> users. This happened with a RHEL 8.5, and I see no remedy for this, >> other than: >> >> - storing a user keytab somewhere in his home folder, and use a >> mechanism (k5start, crond, etc) to fetch new TGT's, but seems to be a >> potential security risk; >> - having some cron job that checks for expired credentials and kills >> all >> processes of that user to avoid a problem with the machine. >> >> Would you have any idea of something out of these lines? >> >> Best, >> >> Francis >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to >> freeipa-users-leave(a)lists.fedorahosted.org >> Fedora Code of Conduct: >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ [1] >> List Guidelines: >> https://fedoraproject.org/wiki/Mailing_list_guidelines [2] >> List Archives: >> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >> [3] >> Do not reply to spam on the list, report it: >> https://pagure.io/fedora-infrastructure [4] >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to >> freeipa-users-leave(a)lists.fedorahosted.org >> Fedora Code of Conduct: >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ [1] >> List Guidelines: >> https://fedoraproject.org/wiki/Mailing_list_guidelines [2] >> List Archives: >> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >> [3] >> Do not reply to spam on the list, report it: >> https://pagure.io/fedora-infrastructure [4] > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to > freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > Do not reply to spam on the list, report it: > https://pagure.io/fedora-infrastructure Links: ------ [1] https://docs.fedoraproject.org/en-US/project/code-of-conduct/ [2] https://fedoraproject.org/wiki/Mailing_list_guidelines [3] https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… [4] https://pagure.io/fedora-infrastructure

1 0

Re: Strategy to renew TGT - any thoughts?
by Francis Augusto Medeiros-Logeay 24 Apr '22

24 Apr '22

Hey Charles, Thanks a lot for what you just described - it gives me a lot to think about. If you have th etime, could you describe how the pam module is called from the cron job, and how the TGT is fetched for the users? I mean, if it is a cron job, how the tgt is fetched without passwords? And how does the kdc issues the ticket? This info would help me a lot! Best, Francis --- Francis Augusto Medeiros-Logeay Oslo, Norway On 2022-04-22 20:59, Charles Hedrick via FreeIPA-users wrote: > We have a script that renews all tickets that are still in use, and > kills those that are not. The original version of this is a bit > complex, but I now have a bash script in testing that seems reasonable. > > I agree that keytables are a bit of a risk. They work on any host, and > root can steal them. Here's what we do instead: For cron jobs, a user > registers that they want to run cron jobs on a specific host. There's a > pam module that will get a TGT for them when a cron job starts. It > talks to a daemon on the kdc that verifies that they authorized it to > issue tickets for that host and returns a ticket. The tickets are > locked to that IP address and are not forwardble (since we are only > using them from NFS). > > None of this code is specific to Rutgers, but the script requires less > infrastructure than the cron support. I have concerns about what we're > doing for cron. I suspect the right solution is to use constrained > delegation for NFS. I think that can be done with gssproxy. > > ------------------------- > > From: Francis Augusto Medeiros-Logeay via FreeIPA-users > <freeipa-users(a)lists.fedorahosted.org> > Sent: Friday, April 8, 2022 2:19 PM > To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Cc: Sam Morris <sam(a)robots.org.uk>; Alexander Bokovoy > <abokovoy(a)redhat.com>; Francis Augusto Medeiros-Logeay <r_f(a)med-lo.eu> > Subject: [Freeipa-users] Re: Strategy to renew TGT - any thoughts? > > On 2022-04-08 10:57, Alexander Bokovoy via FreeIPA-users wrote: >> On pe, 08 huhti 2022, Francis Augusto Medeiros-Logeay via >> FreeIPA-users >> wrote: > >>> I've looked k5start before, and, correct me if I am wrong, but the >>> difference between using a `kinit -k -i | -t keytab` and k5start is >>> that the later takes care of the daemonization aspect, right? As I >>> see >>> it, both need a keytab to work. The issue for me here is that it is a >>> bit undesirable to leave a keytab around. What I like about FreeIPA >>> is >>> that you can fetch the keytab from a cached credential, so that it >>> you >>> could fetch it, use k5start or kinit -kt, and then erase it. >>> >>> I guess there's no way to renew those tickets without a keytab, >>> right? >> >> Nope -- unless you store that password somewhere and run a systemd >> timer, effectively. >> >> If you store your user credentials into a keytab and just set >> KRB5_CLIENT_KTNAME, this will work too. A systemd timer could be used >> to >> replace k5start. >> >> Alternatively, gssproxy could be used for that. It already knows how >> to >> handle NFS, for example, so it would work just fine. But it also >> expects >> to have a keytab in a proper place. > > Thanks a lot, Alexander. > > I am clueless now on how to solve this. We experienced that, on > machines > where the user uses nfsv4+kerberos to mount their home directory, what > happens is that if the user has some job that writes to some file on > his > home directory, the machine goes bananas if the ticket expires (ie, if > the user goes on vacation and doesn't log in). This is already a > problem > for a machine with one user, imagine when the machine has dozens of > users. This happened with a RHEL 8.5, and I see no remedy for this, > other than: > > - storing a user keytab somewhere in his home folder, and use a > mechanism (k5start, crond, etc) to fetch new TGT's, but seems to be a > potential security risk; > - having some cron job that checks for expired credentials and kills > all > processes of that user to avoid a problem with the machine. > > Would you have any idea of something out of these lines? > > Best, > > Francis > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to > freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ [1] > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > [2] > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > [3] > Do not reply to spam on the list, report it: > https://pagure.io/fedora-infrastructure [4] > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to > freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > Do not reply to spam on the list, report it: > https://pagure.io/fedora-infrastructure Links: ------ [1] https://docs.fedoraproject.org/en-US/project/code-of-conduct/ [2] https://fedoraproject.org/wiki/Mailing_list_guidelines [3] https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… [4] https://pagure.io/fedora-infrastructure

2 1

dse.ldif and dse.ldif.bak gone after powerloss
by Sigbjorn Lie 22 Apr '22

22 Apr '22

Hi, We recently had a failure causing an IPA server to experience an immediate powerloss. When the server power was switched back on, the dirsrv service refused to start. The following we're logged in journalctl. Apr 19 10:58:13 ipa2.redacted.tld ns-slapd[2811868]: [19/Apr/2022:10:58:13.757492036 +0200] - INFO - dse_check_file - The config /etc/dirsrv/slapd-REDACTED/dse.ldif can not be accessed. Attempting restore ... (reason: 0) Apr 19 10:58:13 ipa2.redacted.tld ns-slapd[2811868]: [19/Apr/2022:10:58:13.757544913 +0200] - ERR - dse_check_file - The backup file /etc/dirsrv/slapd-REDACTED/dse.ldif.bak has zero length, refusing to restore it. Apr 19 10:58:13 ipa2.redacted.tld ns-slapd[2811868]: [19/Apr/2022:10:58:13.757548466 +0200] - ERR - slapd_bootstrap_config - No valid configurations can be accessed! You must restore /etc/dirsrv/slapd-REDACTED/dse.ldif from backup! Apr 19 10:58:13 ipa2.redacted.tld ns-slapd[2811868]: [19/Apr/2022:10:58:13.757551275 +0200] - EMERG - main - The configuration files in directory /etc/dirsrv/slapd-REDACTED could not be read or were not found. Please refer to the error log or output for more info Upon further troubleshooting we discovered that /etc/dirsrv/slapd-REDACTED/dse.ldif was missing, and /etc/dirsrv/slapd-REDACTED/dse.ldif.backup was 0 bytes long. The dse.ldif.startOK file is still there, however it is now over 2 months old. # ls -la dse.ldif.* -rw-------. 1 dirsrv dirsrv 0 Apr 11 14:42 dse.ldif.bak -rw-------. 1 dirsrv root 173135 Feb 9 13:33 dse.ldif.ipa.dd88c8e1bbf92a7c -rw-rw----. 1 dirsrv root 194829 Feb 9 13:33 dse.ldif.modified.out -rw-------. 1 dirsrv dirsrv 226867 Feb 17 11:41 dse.ldif.startOK When inspecting some of our other still running IPA servers, the difference between the dse.ldif and the dse.ldif.startOK displays updates to modifyTimestamp and nsState on entries such as: dn: cn=replica,cn=o\3Dipaca,cn=mapping tree,cn=config dn: cn=uniqueid generator,cn=config dn: cn=abort cleanallruv,cn=tasks,cn=config dn: cn=automember export updates,cn=tasks,cn=config dn: cn=automember rebuild membership,cn=tasks,cn=config dn: cn=backup,cn=tasks,cn=config dn: cn=cleanallruv,cn=tasks,cn=config dn: cn=compact db,cn=tasks,cn=config dn: cn=des2aes,cn=tasks,cn=config dn: cn=entryuuid task,cn=tasks,cn=config ... and the list goes on ... I would presume the list on the faulty IPA server to be similar if I still had the files available for comparison. What is the recommended action to enable the faulty IPA server to successfully start the dirsrv service? Regards, Siggi

2 1

c9s - Java update brakes IPA - ?
by lejeczek 21 Apr '22

21 Apr '22

Hi guys. @devel perhaps could comment if it's Java among package updates which breaks PKI ? ... ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='whale.mine.private', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f9c31d7ba60>: Failed to establish a new connection: [Errno 111] Connection refused')) WARNING: Some of the specified [protocols] are not supported by the SSL engine and have been skipped: [[TLSv1, TLSv1.1]] SEVERE: Error deploying deployment descriptor [/etc/pki/pki-tomcat/Catalina/localhost/ca.xml] java.lang.IllegalStateException: Error starting child at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:720) at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:720) at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:129) at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:150) at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:140) at java.base/java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:688) at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:706) ... ... at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:717) ... 41 more Caused by: java.lang.UnsupportedClassVersionError: netscape/ldap/LDAPException has been compiled by a more recent version of the Java Runtime (class file version 61.0), this version of the Java Runtime only recognizes class file versions up to 55.0 at java.base/java.lang.ClassLoader.defineClass1(Native Method) at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1017) ... SEVERE: One or more listeners failed to start. Full details will be found in the appropriate container log file SEVERE: Context [/acme] startup failed due to previous errors WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by org.apache.catalina.loader.WebappClassLoaderBase (file:/usr/share/java/tomcat/catalina.jar) to field java.io.ObjectStreamClass$Caches.localDescs WARNING: Please consider reporting this to the maintainers of org.apache.catalina.loader.WebappClassLoaderBase WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations ... java-11-openjdk-devel-11.0.15.0.1-0.1.ea.el9.x86_64 ipa-server-4.9.8-6.el9.x86_64 or this is some issue irrespective of java? many thanks, L.

4 7

Postfix and FreeIPA
by Francis Augusto Medeiros-Logeay 20 Apr '22

20 Apr '22

Hi, I was wondering, it would be very cool if FreeIPA could include the storage of virtual accounts and domains so that it could easily integrate with Postfix. I am willing to start to develop such integration, but wanted first to ask here if there's a smarter way to do so, or if this could be useful for others. My idea would involve: - creating an nsContainer named "virtualaccounts"; - creating an objectClass of type "virtualaccount" for virtual domains and virtual accounts, pointing to a real mailbox (which would always be a user) - extending the UI to get the mailQuota field to users (adding mailRecipient objectClass to the default list as well) - extending the UI to add a new menu, probably under "Identities", for adding/editing/deleting virtual domains and aliases. Does this seem a good way to go, or this could be accomplished in a simpler way? Best, -- Francis Augusto Medeiros-Logeay Oslo, Norway

2 3

Ldapsearch on employeenumber requires Directory Manager access?
by Jim Kinney 20 Apr '22

20 Apr '22

I need to compare a number stored on CAC with the one in employeenumber in IdM. I have a non-admin bind user for this and other generic LDAP data access for 3rd party needs. But only the Directory Manager can pull that field. Is there a permission setting to allow a system account to access that field? The account was created using the method from redhat solutions 4408441. -- Computers amplify human error Super computers are really cool

3 3

Use SSH keys in FreeIPA to access local account on server?
by Jonathan Vaughn 20 Apr '22

20 Apr '22

We have some systems which are FreeIPA connected, but (most) users don't log in as themselves, there's a local system account they use instead (simplifies file ownership for website changes and such, for example). Is there a way to have their public keys automatically accepted for this local user, via SSSD/FreeIPA, like it is if they log in as themselves? We could just use a cron job to regenerate the authorized_keys from the keys in LDAP, but if we can do it magically through an RBAC thing or something, that would be ideal.

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2022