January 2024 - FreeIPA-users - Fedora mailing-lists

Freeipa sudo
by Dmitry Krasov 18 Jan '24

18 Jan '24

Hello. The FreeIpa user has sudo rights on a Ubuntu 2204 desktop machine that is in the FreeIpa Linux domain. It can do sudo su, sudo apt install… But when starting some services and basic installation of applications from the market (in general, when it comes to gui admin rights), it asks the local administrator password. How can I fix this so the user’s password was requested from FreeIpa or not at all?

2 9

Is there any way to disable TOTP watermark support?
by Heo Paul 17 Jan '24

17 Jan '24

I use the core server (fedora 39, ipa-version : 4.11.0) I know that freeipa server adds TOTP watermark support since 4.1 version. But for some reason, I need to reuse otp-code from generated with TOPT for short time to login but it fails with otp watermark. Are there any ways to disable the feature from server side? Thanks in advance.

2 1

Redundancy and failover practices
by Justin Sanderson 15 Jan '24

15 Jan '24

I have built a 4 node environment in which all 4 servers have CA and domain replication via a tight-cell topology. I have some questions about redundancy and failover. 1. How are user logins affected if my master dies? 2. I understand that sssd has some built-in failover capabilities but is there anything that I need to do on the DNS SRV records for ldap and kerberos? 3. Is failover even a thing for krb5/ldap services since they're replicating? Overall, I would like some detail about what to do and how, when my master goes down? I see a decent amount of information about how to set it all up but how do I actually make use of it in the event of server failure? Any in-depth docs/info on this topic would be appreciated. Thanks in advance.

1 0

Bind9/named 4.10.2 segfaults under dnssec load, ISC points to lib version mismatches.
by Harry G Coin 15 Jan '24

15 Jan '24

Under opendnssec processing load, bind9 segfaults under v 4.10.2. The only mitigation was to add systemd restart override. Details here: https://gitlab.isc.org/isc-projects/bind9/-/issues/4533 Coredumps available. The ISC devs closed the issue with this comment: "Yeah, SoftHSM2 is pretty much broken with OpenSSL 3. If you want this to work, you need to compile both BIND 9 and SoftHSM2 to be compiled with OpenSSL 1.1. (The worst you can do is to compile one with OpenSSL 3 and second with OpenSSL 1.1, SoftHSM2 leaks symbols into the address space.) There’s also a libnss file provider that can be used as alternative. But combining old and new will not work here. SoftHSM2 is basically in maintained as of not. There’s nothing we can do here on BIND 9 side. There will be support for OpenSSL 3 providers in future, but not in the version near EOL." Looks like the freeipa team has some choices to make re: named-bind/opendnssec/softhsm2/pcks11/openssl ! Thanks Harry

1 0

Re: Greenfield FreeIPA deployment - is it OK to put FreeIPA at the domain apex, or a "best practice" to put it in a subdomain?
by Thomas Letherby 12 Jan '24

12 Jan '24

I say always use a subdomain. You don't lose much (apart from a slightly longer domain to type in) but you get a whole lot more flexibility. If you need to stand up Active Directory, or another FreeIPA forest separate from the first, you can keep it in the same namespace and not worry about conflicts. You can use CNAMEs in the root for user accessed things to keep URLs short, and you don't have the issue of people not being able to use the company website without www.... Thomas On Thu, Jan 11, 2024 at 8:06 AM Paul Wilcox via FreeIPA-users < freeipa-users(a)lists.fedorahosted.org> wrote: > Older thread, curious which direction you went with. > > I am kind of deciding the same as you. Build it with root domain and > then have resource domains or do a subdomain to start. Have not really > found a best practice guide. > > Wonder how redhat does there domain setup. > > -- > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue >

1 0

Old Home Folders and Free ipa users
by Alper AYKUT 12 Jan '24

12 Jan '24

Hello I have 5 servers. The users of all servers are created locally. All users have Home. Now I will connect the Servers to the Free ipa server to enable them to log in with the Users I have created in Free IPA. However, how will the users' home folders that were created in the past match the User created in Free ipa? Or will the users need to delete their home folders to be created again. If I need to delete the Home folders of the users, I will need to back up the data of all users. This is a huge workload. Thankyou for support.

4 5

[SSSD] Announcing SSSD 2.9.4
by Pavel Březina 12 Jan '24

12 Jan '24

# SSSD 2.9.4 The SSSD team is announcing the release of version 2.9.4 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.4 See the full release notes at: https://sssd.io/release-notes/sssd-2.9.4.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.9.4 Release Notes ## Highlights ### Important fixes * Fixes a crash when PAM passkey processing incorrectly handles non-passkey data. * A workaround was implemented to handle gracefully misbehaving applications that destroy internal state of SSSD client librarires. A particular example of such application is described in https://github.com/TigerVNC/tigervnc/issues/1709. * An error when rotating KCM's logs was fixed. When KCM's logs were rotated by logrotate, KCM would still use the old file (renamed sssd_kcm.log.1). Only after KCM was restarted (either manually or automatically) the new log file would be used. This problem is now solved and KCM uses the new file immediately. * Fixed group membership handling when members are coming from different forest domains and using ldap token groups is prohibited. * Files provider was erroneously taking into consideration `local_auth_policy` config option, thus breaking smartcard authentication of local user in setups that didn't explicitly specify this option. This is now fixed.

1 0

Greenfield FreeIPA deployment - is it OK to put FreeIPA at the domain apex, or a "best practice" to put it in a subdomain?
by Braden McGrath 11 Jan '24

11 Jan '24

Hello FreeIPA-users. The Subject line is the core of my question here; I'll provide a bit more detail below. I work for what is (effectively) a startup, non-profit internet provider. I have an extensive Windows background, and "know enough to be dangerous" with Linux & BSD (have been tinkering with GNU/Linux on and off since Slackware 3.0 or 3.1). I'm very familiar with Windows Active Directory, but the org does not have any AD infrastructure right now (and being nonprofit, are trying to avoid spending money for MS, especially when all of the other VMs will be Linux or BSD anyway). Given the nonprofit nature, I discovered FreeIPA when looking for a free centralized directory system. The goal is to consolidate all credentials for *other* Linux VMs (customer-facing DNS, CRM web server, SNMP/network graphing servers, etc) as well as provide a back-end for RADIUS for management of network equipment (switches, routers, P2P wireless, etc). Simplifying DNS management and replication is also appealing, I'd rather administrate one system than two or three. In case it changes your opinion of the plan at all - all of the network equipment and VMs will be on *private* (10.x) IPv4 space and behind one or more firewalls, at least initially. We do want to add public IPv6, but do not have that yet. We only have a small allocation (/26) of public v4 from our upstream that will be NATed through a firewall and not directly on any devices. The traffic to FreeIPA is going to be internal-only, I do not plan on exposing FreeIPA's DNS "to the world" at all. Even customer-facing internal DNS will likely be through separate caching forwarders pointing back to FreeIPA. I have a completely unused, publicly registered domain (let's just call it "example.net" for this thread) available to dedicate to this system. We also own "example.org" and are using that for our public web presence, and I intend to keep that entirely standalone. Given that I have no current "interoperability" concerns, is there anything "wrong" with putting FreeIPA directly at the root of example.net? Or would it be more wise, from an interop, security, or manageability standpoint (i.e. a "best practice"), to root FreeIPA at something like auth.example.net or ipa.example.net and then have a separate set of nameservers handling the base domain? If I put FreeIPA's root (and Kerberos realm) in a subdomain, is it possible to *also* have it manage the parent domain's DNS entries? I've read through the Quick Start Guide and Deployment Recommendations (https://www.freeipa.org/page/Deployment_Recommendations) which is part of how I've come to the decisions I've made thus far. I couldn't really find guidance one way or the other on whether FreeIPA "should" be in a subdomain or not, hence this posting. I would appreciate any insight the community can provide!

3 4

FreeIPA web session timeout
by Yuri Krysko 11 Jan '24

11 Jan '24

Hello, Could you please advise how to configure FreeIPA web UI user session timeout? Thanks, Yuri ________________________________ LEGAL DISCLAIMER: M.C. Dean, Inc. and its subsidiaries considers this e-mail and any files transmitted with it to be protected, proprietary or privileged information intended solely for the use of the named recipient(s). Any disclosure of this material or the information contained herein, in whole or in part, to anyone outside of the intended recipient or affiliates is strictly prohibited. M. C. Dean, Inc. accepts no liability for the content of this e-mail or for the consequences of any actions taken on the basis of the information contained in it, unless that information is subsequently confirmed in writing. Employees of M.C. Dean, Inc. are instructed not to infringe on any rights of the recipient; any such communication violates company policy. If you are not the intended recipient, any disclosure, copying, distribution, or action taken or omitted in reliance on this information is strictly prohibited by M.C. Dean, Inc.; please notify the sender immediately by return e-mail, delete this communication and destroy all copies.

4 4

FreeIPA security fix releases
by Antonio Torres 10 Jan '24

10 Jan '24

Hello, The FreeIPA team would like to announce the following security fix releases: 4.6.10: https://www.freeipa.org/release-notes/4-6-10.html 4.9.14: https://www.freeipa.org/release-notes/4-9-14.html 4.10.3: https://www.freeipa.org/release-notes/4-10-3.html 4.11.1: https://www.freeipa.org/release-notes/4-11-1.html

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2024