September 2023 - FreeIPA-users - Fedora mailing-lists

Has anyone tried FreeIPA with RSA's SecurID® Authentication Agent for PAM ?
by White, Daniel E. (GSFC-770.0)[AEGIS] 22 Sep '23

22 Sep '23

Has anyone tried FreeIPA with RSA's SecurID® Authentication Agent for PAM ? https://community.rsa.com/t5/securid-authentication-agent-for/tkb-p/auth-ag…

1 0

Lost password for CA private key
by John Stokes 22 Sep '23

22 Sep '23

I have an IPA CA that is running fine for several years now. I also have two replicas installed. Today while creating a backup I realized I don't know the password for the file /root/cacert.p12 where the private key of the CA should be stored. The one I thought it should be (same as the pass for my admin user) does not seem to be working. Is there a way to reexport the private key of the CA? As I said everything is working fine and I have access to the server. If not how should I proceed? Should I destroy the whole CA and build a new one?

3 8

prevent 'sudo -i ' from executing
by Nathanaël Blanchet 21 Sep '23

21 Sep '23

Hello, I don't want my users to become root with simply executing the 'sudo -i' command so they can execute all root commands. Users should only execute with sudo the allowed defined commands. I'm able to prevent them from executing 'sudo su -', but I didn't find any informations about forbidding 'sudo -i'. Thank you for your help. -- Nathanaël Blanchet Administrateur Systèmes et Réseaux Service Informatique et REseau (SIRE) Département des systèmes d'information 227 avenue Professeur-Jean-Louis-Viala 34193 MONTPELLIER CEDEX 5 Tél. 33 (0)4 67 54 84 55 Fax 33 (0)4 67 54 84 14 blanchet(a)abes.fr

5 7

RedHat and 2FA Problem
by Sirio Sannipoli 21 Sep '23

21 Sep '23

Hello everyone, I've already done searches without success, I need someone to point me in the direction of resolving a strange behavior I'm experiencing on servers with the RedHat/Centos operating system. I have installed FreeIPA 4.10.1 on Oracle Linux 9 and all users by default have Radius authentication via a Cisco server, users can access via SSH to 100 Servers configured, we have OS of all types (Debian, RedHat, Centos, Ubuntu). The behavior I get is the following: Debian based distro: SSH Login and SUDO work perfectly using the Radius credentials RedHat based distro: SSH Login prompt ask for 2FA, first factor & second factor (optional) and i can login by entering the Radius credentials and using the same password 2 times, SUDO ask for 2FA and authentication fails when entering the same password 2 times. I don't understand if the problem is on the FreeIPA client or server or why there is a difference in behavior between Debian and RedHat systems. Can anyone give me directions to understand what's happening? Note: I have never set up 2FA authentication on the FreeIPA server, the users are correctly configured and the "ipa user-show" command confirms "User authentication types: radius", if i change user configuration with the password, everything works fine.

4 4

External bind with certs with sysaccounts
by Tania Hagan 21 Sep '23

21 Sep '23

Hi Freeipa-users, Is is possible to create a binddn account in cn=sysaccounts and attach certs to the account so it can be used in scripts to bind using external bind with certs? I know how to create my sysaccount and I found https://www.freeipa.org/page/V4/User_Certificates which provides instructions on attaching certificates to user accounts but not sure how this references to attaching certs to sysaccounts. Many Thanks, Tania

2 3

not thinking with the design of bind-dyndb-ldap
by Marc 21 Sep '23

21 Sep '23

1. Wtf are you assuming the ldap server is writable? Why would you think that changing this opposed to the older version is an improvement? 2. wtf do you want to download the whole ldap via sync? What is even the point of having it in ldap? My old named is using < 500MB, your new version is 700MB + 500MB swap. Now everything is slow because you grab 99% data that is not even queried. This plugin was good and you fucked it up, on security and on performance!!!

2 1

Would like to set up a "least privilege" admin only capable of managing POSIX groups, not users.
by Chris Cowan 21 Sep '23

21 Sep '23

Reading through the docs carefully, but I'm just wondering if anyone else has done this, and if there are any "gotchas" I have to worry about?

4 9

getting error "serial (xxxxxxxx) write back to LDAP failed"
by Marc 21 Sep '23

21 Sep '23

getting errors like this "serial (xxxxxxxx) write back to LDAP failed" Probably because it is trying to write to ldap? How to turn of this?

1 0

Re: help troubleshooting AD auth issue with FreeIPA
by Rob Crittenden 20 Sep '23

20 Sep '23

Ostrom, Erik via FreeIPA-users wrote: > Hi, > > I've got a fresh FreeIPA server running on Rocky 9, and I'm having > trouble diagnosing issues with a one way incoming external trust with an > active directory server. > > It looks like the trust is properly created on both sides and verified, > but when I try to log in with an AD user to the FreeIPA server via SSH, > I get permission denied (after asking for my password 3 times). I'm also > having trouble finding where any of this login process is being logged > on the FreeIPA side. > > Could I get some help figuring out where to look for logs related to > this failed AD login and how to troubleshoot a failure like this? I'd suggest starting with https://sssd.io/troubleshooting/basics.html rob > > IPA server details: > > [root@freeipa1 ~]# ipa --version > VERSION: 4.10.1, API_VERSION: 2.251 > [root@freeipa1 ~]# cat /etc/*release* > NAME="Rocky Linux" > VERSION="9.2 (Blue Onyx)" > ID="rocky" > ID_LIKE="rhel centos fedora" > VERSION_ID="9.2" > PLATFORM_ID="platform:el9" > PRETTY_NAME="Rocky Linux 9.2 (Blue Onyx)" > ANSI_COLOR="0;32" > LOGO="fedora-logo-icon" > CPE_NAME="cpe:/o:rocky:rocky:9::baseos" > HOME_URL="https://rockylinux.org/" > BUG_REPORT_URL="https://bugs.rockylinux.org/" > SUPPORT_END="2032-05-31" > ROCKY_SUPPORT_PRODUCT="Rocky-Linux-9" > ROCKY_SUPPORT_PRODUCT_VERSION="9.2" > REDHAT_SUPPORT_PRODUCT="Rocky Linux" > REDHAT_SUPPORT_PRODUCT_VERSION="9.2" > Rocky Linux release 9.2 (Blue Onyx) > Rocky Linux release 9.2 (Blue Onyx) > Derived from Red Hat Enterprise Linux 9.2 > Rocky Linux release 9.2 (Blue Onyx) > cpe:/o:rocky:rocky:9::baseos > [root@freeipa1 ~]# > > Thanks, > Erik > > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue >

1 0

help troubleshooting AD auth issue with FreeIPA
by Ostrom, Erik 20 Sep '23

20 Sep '23

Hi, I've got a fresh FreeIPA server running on Rocky 9, and I'm having trouble diagnosing issues with a one way incoming external trust with an active directory server. It looks like the trust is properly created on both sides and verified, but when I try to log in with an AD user to the FreeIPA server via SSH, I get permission denied (after asking for my password 3 times). I'm also having trouble finding where any of this login process is being logged on the FreeIPA side. Could I get some help figuring out where to look for logs related to this failed AD login and how to troubleshoot a failure like this? IPA server details: [root@freeipa1 ~]# ipa --version VERSION: 4.10.1, API_VERSION: 2.251 [root@freeipa1 ~]# cat /etc/*release* NAME="Rocky Linux" VERSION="9.2 (Blue Onyx)" ID="rocky" ID_LIKE="rhel centos fedora" VERSION_ID="9.2" PLATFORM_ID="platform:el9" PRETTY_NAME="Rocky Linux 9.2 (Blue Onyx)" ANSI_COLOR="0;32" LOGO="fedora-logo-icon" CPE_NAME="cpe:/o:rocky:rocky:9::baseos" HOME_URL="https://rockylinux.org/" BUG_REPORT_URL="https://bugs.rockylinux.org/" SUPPORT_END="2032-05-31" ROCKY_SUPPORT_PRODUCT="Rocky-Linux-9" ROCKY_SUPPORT_PRODUCT_VERSION="9.2" REDHAT_SUPPORT_PRODUCT="Rocky Linux" REDHAT_SUPPORT_PRODUCT_VERSION="9.2" Rocky Linux release 9.2 (Blue Onyx) Rocky Linux release 9.2 (Blue Onyx) Derived from Red Hat Enterprise Linux 9.2 Rocky Linux release 9.2 (Blue Onyx) cpe:/o:rocky:rocky:9::baseos [root@freeipa1 ~]# Thanks, Erik

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2023