May 2023 - FreeIPA-users - Fedora mailing-lists

New primary rid range overlaps with existing primary rid range
by Andreas Binapfl 22 May '23

22 May '23

Greetings, we also upgraded to RHEL9.2 and got the auth problems. following the advice here i wanted to use "ipa config-mod --enable-sid --add-sids" but unfortunately i get an error in /etc/messages ERR - ipa_range_check_pre_op - [file ipa_range_check.c, line 670]: New primary rid range overlaps with existing primary rid range. Using ipa idrange-find ---------------- 3 ranges matched ---------------- Range name: DOMAIN.LOCAL_id_range First Posix ID of the range: 512800000 Number of IDs in the range: 200000 First RID of the corresponding RID range: 1000 First RID of the secondary RID range: 100000000 Range type: local domain range Range name: DOMAIN.LOCAL_new_range First Posix ID of the range: 1600 Number of IDs in the range: 2000 Range type: local domain range Range name: DOMAIN.LOCAL_subid_range First Posix ID of the range: 2147483648 Number of IDs in the range: 2147352576 First RID of the corresponding RID range: 2147283648 Domain SID of the trusted domain: S-1-5-21-738065-838566-2958400175 Range type: Active Directory domain range ---------------------------- Number of entries returned 3 On a first glance they seems not to overlap. Can someone help me how i can troubleshoot that problem further?

2 11

Disabled Domain fills IPA client sssd logs
by Ronald Wimmer 22 May '23

22 May '23

We do face the problem that we disabled a domain we do not need and that this particular domain fills up sssd logs on the client side. Especially sssd_nss.log. How could we possibly avoid this behavior? Cheers, Ronald

2 5

Eliminating Basic Auth Prompt When Accessing FreeIPA Direct
by Jeff Hochberg 20 May '23

20 May '23

Hello! Having only used it once...it's fair to say I'm a relatively new FreeIPA user. I'm seeing undesirable behavior that I am unsure of how to disable. Any time I use a browser to connect to the FreeIPA server, I see a Basic Auth prompt challenging me for username/password. I have to click cancel twice, then I see the forms-based login prompt - which is what I want to see by default. Interestingly enough, I do not see the basic auth prompt when using Firefox. It only seems to happen with Chromium-based browsers. I've tried searching for info on how to disable the basic auth prompt, but have not found anything as of yet. Would someone please provide some guidance? Thanks in advance! Best Regards, -JeffH

3 4

failed to create/enable SID
by alexey safonov 19 May '23

19 May '23

After upgrading to RHEL 9.2 it seems I must enable SID in my prod setup. So when I tried I'm getting an error message [18/May/2023:23:09:46.570447195 +0800] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [18/May/2023:23:09:46.571579606 +0800] - ERR - sidgen_task_add - [file ipa_sidgen_task.c, line 283]: Cannot find ranges. After investigating/search forum it seems like an error with my ID range. But I can't get why. I have no overlaps ---------------- 4 ranges matched ---------------- dn: cn=INT.LHFT.IO_id_range,cn=ranges,cn=etc,dc=int,dc=lhft,dc=io cn: INT.LHFT.IO_id_range ipabaseid: 1368600000 ipaidrangesize: 200000 ipabaserid: 100000 iparangetype: ipa-local objectclass: top objectclass: ipaIDrange objectclass: ipaDomainIDRange dn: cn=INT.LHFT.IO_subid_range,cn=ranges,cn=etc,dc=int,dc=lhft,dc=io cn: INT.LHFT.IO_subid_range ipabaseid: 2147483648 ipaidrangesize: 2147352576 ipabaserid: 2147283648 ipanttrusteddomainsid: S-1-5-21-738065-838566-328754306 iparangetype: ipa-ad-trust objectclass: top objectclass: ipaIDrange objectclass: ipaTrustedADDomainRange dn: cn=LHFT_1,cn=ranges,cn=etc,dc=int,dc=lhft,dc=io cn: LHFT_1 ipabaseid: 10000 ipaidrangesize: 10000 ipabaserid: 10000 iparangetype: ipa-local objectclass: ipaIDrange objectclass: ipadomainidrange dn: cn=LHFT_2,cn=ranges,cn=etc,dc=int,dc=lhft,dc=io cn: LHFT_2 ipabaseid: 4000 ipaidrangesize: 5000 ipabaserid: 1000 iparangetype: ipa-local objectclass: ipaIDrange objectclass: ipadomainidrange ---------------------------- Number of entries returned 4 ---------------------------- [root@lt-hk1-avm01 asafonov]# Any ideas why I can't enable/generate SIDs?

3 3

FreeIPA 4.9.12
by Antonio Torres 19 May '23

19 May '23

1 0

RHEL Identity Management (IdM): set up IPA client: Failed to update DNS records, Could not update DNS SSHFP records
by Eric Miller 19 May '23

19 May '23

Please see: https://discussion.fedoraproject.org/t/rhel-identity-management-idm-set-up-… for more detail, because I have images to help understand and see my network infrastructure. Thanks!...

1 0

Authentication failures on a RHEL 9.2 IPA server
by Sam Morris 17 May '23

17 May '23

Hi folks. This morning I found that one of my IPA servers no longer wants to authenticate any users (specifically, it doesn't want to issue any TGTs to users). It's a fully updated RHEL 9 server; I am sure this has only been a problem since upgrading to RHEL 9.2 (see my remarks about krb5kdc.log below); my other servers are on RHEL 8 and are working fine. Package versions: ipa-client-common-4.10.1-6.el9.noarch ipa-server-common-4.10.1-6.el9.noarch ipa-healthcheck-core-0.12-1.el9.noarch ipa-selinux-4.10.1-6.el9.noarch ipa-common-4.10.1-6.el9.noarch ipa-client-4.10.1-6.el9.x86_64 ipa-server-4.10.1-6.el9.x86_64 ipa-server-dns-4.10.1-6.el9.noarch ipa-healthcheck-0.12-1.el9.noarch I see the following syslog messages when trying to SSH in to the server: May 12 08:34:52 sshd[2207]: main: sshd: ssh-rsa algorithm is disabled May 12 08:34:52 sshd[2207]: Postponed keyboard-interactive for user from 192.168.0.23 port 42210 ssh2 [preauth] May 12 08:34:56 sshd[2207]: Postponed keyboard-interactive/pam for user from 192.168.0.23 port 42210 ssh2 [preauth] May 12 08:35:02 ipa-otpd[2200]: user(a)EXAMPLE.COM: request received May 12 08:35:02 ipa-otpd[2200]: user(a)EXAMPLE.COM: user query start May 12 08:35:02 ipa-otpd[2200]: user(a)EXAMPLE.COM: user query end: uid=user,cn=users,cn=accounts,dc=ipa,dc=example,dc=com May 12 08:35:02 ipa-otpd[2200]: user(a)EXAMPLE.COM: bind start: uid=user,cn=users,cn=accounts,dc=ipa,dc=example,dc=com May 12 08:35:02 ipa-otpd[2200]: user(a)EXAMPLE.COM: bind end: success May 12 08:35:02 ipa-otpd[2200]: user(a)EXAMPLE.COM: sent: 0 data: 20 May 12 08:35:02 ipa-otpd[2200]: user(a)EXAMPLE.COM: ..sent: 20 data: 20 May 12 08:35:02 ipa-otpd[2200]: user(a)EXAMPLE.COM: response sent: Access-Accept May 12 08:35:02 krb5_child[2213]: Generic error (see e-text) May 12 08:35:02 krb5_child[2213]: Generic error (see e-text) May 12 08:35:02 sshd[2211]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.23 user=user May 12 08:35:02 sshd[2211]: pam_sss(sshd:auth): received for user user: 4 (System error) May 12 08:35:04 sshd[2207]: error: PAM: Authentication failure for user from 192.168.0.23 /var/log/sssd/krb5_child.log gives me: (2023-05-12 8:39:50): [krb5_child[2271]] [get_and_save_tgt] (0x0020): [RID#79] 2009: [-1765328324][Generic error (see e-text)] ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2023-05-12 8:39:50): [krb5_child[2271]] [main] (0x0400): [RID#79] krb5_child started. * (2023-05-12 8:39:50): [krb5_child[2271]] [unpack_buffer] (0x1000): [RID#79] total buffer size: [140] * (2023-05-12 8:39:50): [krb5_child[2271]] [unpack_buffer] (0x0100): [RID#79] cmd [241 (auth)] uid [2000000503] gid [2000000503] validate [true] enterprise principal [false] offline [false] UPN [user(a)EXAMPLE.COM] * (2023-05-12 8:39:50): [krb5_child[2271]] [unpack_buffer] (0x0100): [RID#79] ccname: [KCM:] old_ccname: [KCM:] keytab: [/etc/krb5.keytab] * (2023-05-12 8:39:50): [krb5_child[2271]] [switch_creds] (0x0200): [RID#79] Switch user to [2000000503][2000000503]. * (2023-05-12 8:39:50): [krb5_child[2271]] [switch_creds] (0x0200): [RID#79] Switch user to [0][0]. * (2023-05-12 8:39:50): [krb5_child[2271]] [k5c_check_old_ccache] (0x4000): [RID#79] Ccache_file is [KCM:] and is active and TGT is valid. * (2023-05-12 8:39:50): [krb5_child[2271]] [k5c_setup_fast] (0x0100): [RID#79] Fast principal is set to [host/ipa6.example.com(a)EXAMPLE.COM] * (2023-05-12 8:39:50): [krb5_child[2271]] [find_principal_in_keytab] (0x4000): [RID#79] Trying to find principal host/ipa6.example.com(a)EXAMPLE.COM in keytab. * (2023-05-12 8:39:50): [krb5_child[2271]] [match_principal] (0x1000): [RID#79] Principal matched to the sample (host/ipa6.example.com(a)EXAMPLE.COM) * (2023-05-12 8:39:50): [krb5_child[2271]] [check_fast_ccache] (0x0200): [RID#79] FAST TGT is still valid. * (2023-05-12 8:39:50): [krb5_child[2271]] [become_user] (0x0200): [RID#79] Trying to become user [2000000503][2000000503]. * (2023-05-12 8:39:50): [krb5_child[2271]] [main] (0x2000): [RID#79] Running as [2000000503][2000000503]. * (2023-05-12 8:39:50): [krb5_child[2271]] [set_lifetime_options] (0x0100): [RID#79] No specific renewable lifetime requested. * (2023-05-12 8:39:50): [krb5_child[2271]] [set_lifetime_options] (0x0100): [RID#79] No specific lifetime requested. * (2023-05-12 8:39:50): [krb5_child[2271]] [set_canonicalize_option] (0x0100): [RID#79] Canonicalization is set to [true] * (2023-05-12 8:39:50): [krb5_child[2271]] [main] (0x0400): [RID#79] Will perform auth * (2023-05-12 8:39:50): [krb5_child[2271]] [main] (0x0400): [RID#79] Will perform online auth * (2023-05-12 8:39:50): [krb5_child[2271]] [tgt_req_child] (0x1000): [RID#79] Attempting to get a TGT * (2023-05-12 8:39:50): [krb5_child[2271]] [get_and_save_tgt] (0x0400): [RID#79] Attempting kinit for realm [EXAMPLE.COM] * (2023-05-12 8:39:50): [krb5_child[2271]] [sss_krb5_responder] (0x4000): [RID#79] Got question [otp]. * (2023-05-12 8:39:50): [krb5_child[2271]] [get_and_save_tgt] (0x0020): [RID#79] 2009: [-1765328324][Generic error (see e-text)] ********************** BACKTRACE DUMP ENDS HERE ********************************* (2023-05-12 8:39:50): [krb5_child[2271]] [map_krb5_error] (0x0020): [RID#79] 2138: [-1765328324][Generic error (see e-text)] /var/log/krb5kdc.log gives me a "No such file or directory" error: May 12 08:41:31 ipa6.example.com krb5kdc[1575](info): AS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes128-cts-hmac-sha1-96(17)}) 192.168.0.6: NEEDED_PREAUTH: user(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Additional pre-authentication required May 12 08:41:31 ipa6.example.com krb5kdc[1575](info): closing down fd 11 May 12 08:41:31 ipa6.example.com krb5kdc[1575](info): AS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes128-cts-hmac-sha1-96(17)}) 192.168.0.6: NEEDED_PREAUTH: user(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Additional pre-authentication required May 12 08:41:31 ipa6.example.com krb5kdc[1575](info): closing down fd 11 May 12 08:41:42 ipa6.example.com krb5kdc[1575](info): AS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes128-cts-hmac-sha1-96(17)}) 192.168.0.6: NEEDED_PREAUTH: user(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Additional pre-authentication required May 12 08:41:42 ipa6.example.com krb5kdc[1575](info): closing down fd 11 May 12 08:41:42 ipa6.example.com krb5kdc[1573](info): AS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes128-cts-hmac-sha1-96(17)}) 192.168.0.6: NEEDED_PREAUTH: user(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Additional pre-authentication required May 12 08:41:42 ipa6.example.com krb5kdc[1573](info): closing down fd 11 May 12 08:41:42 ipa6.example.com krb5kdc[1573](info): AS_REQ : handle_authdata (2) May 12 08:41:42 ipa6.example.com krb5kdc[1573](info): AS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes128-cts-hmac-sha1-96(17)}) 192.168.0.6: HANDLE_AUTHDATA: user(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, No such file or directory May 12 08:41:42 ipa6.example.com krb5kdc[1573](info): closing down fd 11 There's no instance of this 'No such file or directory' message in krb5kdc.log before this morning, and I did the RHEL 9.2 upgrade on 9th May, just a couple of days ago. So it's possible that this is a problem introduced by the upgrade a couple of days ago, that has been noticed today (perhaps IPA clients were talking to other servers until this morning). Other IPA servers log an ISSUE message at the same point, so I guess the problem is with krb5kdc, I just don't know what to check next. Here's the relevant code (I think) in krb5kdc: <https://github.com/krb5/krb5/blob/e806d1223329fe4b6d9738237893dda27b616bb6/…>. The user is able to log in to the directory server with a simple bind: # ldapwhoami -H ldapi://%2frun%2fslapd-EXAMPLE-COM.socket -D uid=user,cn=users,cn=accounts,dc=ipa,dc=example,dc=com -W Enter LDAP Password: dn: uid=user,cn=users,cn=accounts,dc=ipa,dc=example,dc=com ... so dirsrv seems to be working fine. 'ipactl status' reports all services are running. ipa-healthcheck is giving me one failure, I don't think it's relevant to the krb5kdc errors but it's something I'll look into after: { "source": "pki.server.healthcheck.clones.connectivity_and_data", "check": "ClonesConnectivyAndDataCheck", "result": "ERROR", "uuid": "eb35c2fd-d292-4426-a1ad-8d1adfc5349a", "when": "20230512084503Z", "duration": "10.003213", "kw": { "status": "ERROR: pki-tomcat : Unable to reach KRA at https://ipa6.example.com:443: Request timed out" } }, I am able to run 'kinit -k', e.g,. get a TGT as host/ipa6.example.com, so it's not like krb5kdc is totally busted. It just doesn't work for users any more! As always I'd be grateful for any assistance. :) -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

5 11

http redirect rules - ?
by lejeczek 17 May '23

17 May '23

Hi guys. With default/main redirect rule removed/disabled when I go to: https://swir.mine.priv/ipa I get a broken anchor page (thumbnail is not there), that uti/link points to: https://swir.mine.priv/ui/index.html which, obsviously(?) is not there, does not exist. Would not there be a safe redir rule to fix that? And if yes so, then why (@devel) not have it included in vanilla-default configs? many thanks, L.

2 3

control PKI (& other relevant listened-on address/interface - ?
by lejeczek 17 May '23

17 May '23

Hi. Having more ifaces added to the system I have had http/www portion of IPA run on specific - as opposed to all/any - ip addresses and perfectly, problem-free. I need to do the same with remaining bits but have to start with :8443 which I believed was Tomcat, so did add 'address' into 'server.xml' in /usr/share/tomcat/conf/ but that is not doing it? Where, which bits have to change - even if against best practice & IPA recommendation - to make those IPA components bind to specific ifaces/ip address? many thanks, L.

1 0

sftp HBAC
by Kevin Vasko 17 May '23

17 May '23

Try to make this simple. Have a HBAC, have the "Who" set to a user, have the "Accessing" set to a server. Have the "Via Service" set to "sshd". The user can ssh into the server no issue. I want to limit this user to only being able to sftp into this server (no direct ssh). If I swap the "Via Service" from the sshd service to sftp that user is now denied. They cannot access the server via sftp or ssh. I would expect it to deny ssh access but allow sftp. I did copy "cp /etc/pam.d/sshd /etc/pam.d/sftp" as I saw it mentioned here https://freeipa-users.redhat.narkive.com/tFQFZmNu/hbac-service-allowed-desp… but that didn't seem to work. Can you point me to the instructions on how to make the HBAC work with a particular service (e.g. sftp)?

3 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2023