Hi I deployed a third replica in a dmz network for clients that do not route to the main ipa masters. Not sure if this is a workable setup. I can join clients using --fixed-primary and can logon with AD (one-way trust). This third replica has the trust-agent role. I might be approaching this incorrectly. Posting here for advise, has anyone attepted this and how to approach? It seems to be working, except the sudo rules.
I have posted a diagram here: https://ibb.co/WkQj9yD
On Fri, 21 Jun 2024, slek kus via FreeIPA-users wrote:
Hi I deployed a third replica in a dmz network for clients that do not route to the main ipa masters. Not sure if this is a workable setup. I can join clients using --fixed-primary and can logon with AD (one-way trust). This third replica has the trust-agent role. I might be approaching this incorrectly. Posting here for advise, has anyone attepted this and how to approach? It seems to be working, except the sudo rules.
I have posted a diagram here: https://ibb.co/WkQj9yD
It would be best if you could provide actual logs, not pictures. And ideally those logs should come from both a client and a server.
Hi Alexander, posted the logs to pastebin, since it is quite some data. These logs are from the client only. debug_level = 6 Did a clear of cache, then logged onto the client with a trusted user (AD trust), then did a sudo -l.
pac, pam, sudo sssd logs here: https://pastebin.com/mcYJixXz
sssd_[domain] here: https://pastebin.com/Gy9B6MR8
After some more searching, I see that the client contacts the AD domain controller, asking for AAA record, then connects to the AD forest controller, which is _not_ reachable due to firewall filters. Does ipa-client always need to contact the root DC for a krb ticket (guess this is what is attempted here)?
Hi,
On Fri, Jun 28, 2024 at 4:58 PM slek kus via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
After some more searching, I see that the client contacts the AD domain controller, asking for AAA record, then connects to the AD forest controller, which is _not_ reachable due to firewall filters. Does ipa-client always need to contact the root DC for a krb ticket (guess this is what is attempted here)?
You can refer to https://docs.redhat.com/en/documentation/Red_Hat_Enterprise_Linux/9/html/ins... especially the diagram showing communication sent by IdM clients, and https://docs.redhat.com/en/documentation/Red_Hat_Enterprise_Linux/9/html/ins...
HTH,
flo
-- _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
freeipa-users@lists.fedorahosted.org
-
Alexander Bokovoy -
Florence Blanc-Renaud -
slek kus