November 2017 - FreeIPA-users - Fedora mailing-lists

dns searches fail
by dms.sig＠gmx.fr 24 Nov '17

24 Nov '17

1 0

Slow FreeIPA UI
by Maciej Drobniuch 24 Nov '17

24 Nov '17

Hi All, One of my IPA UI is working very slow. I can observe the issue after moving the VM server onto another host. The machine itself is not overloaded and the number of CPU cores and RAM memory went up. Other IPA UI on other servers are working smoothly. Any ideas how to troubleshoot that? Thank You -- Best regards Maciej Drobniuch Network Security Engineer Collective-Sense,LLC

2 1

FreeIPA & wireless
by Andrew Meyer 24 Nov '17

24 Nov '17

So I was wondering if anyone has FreeIPA setup to do authentication with wireless. We have an ArubaNetworks platform setup to do EAP-PEAP only communicating back to the current OpenLDAP system, but would like to migrate to FreeIPA. I was able to set this up using Meraki MR18s but I have to use a WPA2-PSK (enterprise) with splash page in order to log into my FreeIPA system. I don't know if I will have to put the password in again I am waiting until tonight to test that. All of our laptops are Mac OS X running El Capitan and a few running High Sierra (w/ all of them upgrading eventually). We have under 5 laptops running Windows 7-10 and are mostly hard wired. The issue is that when I log into wireless using FreeIPA I get prompted for a password. It gets added to the keychain but when I shutdown for the night and come back in the next day it asks for the password again the next day. While researching this issue I found that some people have put SSL certificates on the machines. I don't want to create and enroll an SSL cert for EACH user. I would like to get system-wide one deployed IF this is the correct way to go. While this may sound like a ArubaNetworks wireless issue I wanted to pose this question to the mailing list just in case there was a step I missed or didn't do something that might have been documented somewhere and to see if anyone else has had this issue. Thank you in advance!

3 9

RADIUS and FreeIPA
by Andrew Meyer 24 Nov '17

24 Nov '17

After all the emails (thank you for your help) I have most of my Mac OS X clients authenticating to FreeIPA over wireless. Clients running on a 2014 or newer 10.12.5 and up won't work. I suspect this has to do with the TLS version. Tell me if I'm approaching this the right way. I am trying to apply a certificate FROM FreeIPA to FreeRADIUS. I am also trying to register the service within FreeIPA but strugglging with some of the syntax. I have been following this:FreeIPA: Giving permissions to service accounts. — Firstyear's blog-a-log | | | FreeIPA: Giving permissions to service accounts. — Firstyear's blog-a-log Firstyear`s blog-a-log | | | I'm having some trouble adding the privileges and roles:[andrew.meyer@radius01 ~]$ ipa privilege-add-permission 'Radius service' --permission='Radius Service' Privilege name: Radius Service Description: Privileges needed to allow radiusd servers to operate Failed members: permission: Radius Service: permission not found-----------------------------Number of permissions added 0-----------------------------[andrew.meyer@radius01 ~]$ ipa privilege-add-permission 'Radius service' --permission='Radius service' Privilege name: Radius Service Description: Privileges needed to allow radiusd servers to operate Failed members: permission: Radius service: permission not found-----------------------------Number of permissions added 0-----------------------------[andrew.meyer@radius01 ~]$ ipa role-add 'Radius server' --desc="Radius server role"--------------------------Added role "Radius server"-------------------------- Role name: Radius server Description: Radius server role[andrew.meyer@radius01 ~]$ ipa role-add-privilege --privileges="Radius services" 'Radius server' Role name: Radius server Description: Radius server role Failed members: privilege: Radius services: privilege not found----------------------------Number of privileges added 0----------------------------[andrew.meyer@radius01 ~]$

2 1

FreeIPA wiki - emails and notifications working
by Martin Kosek 24 Nov '17

24 Nov '17

Hello all, Related to our dear FreeIPA Wiki running on new platform now, I was able to do several improvements to the wiki, including enabling email infrastructure [1] and related support for *notifications*. You can now Watch a page and you should receive an email when the page is modified by someone. From the logs, I can see that some of you already received such emails. Just as a reminder, I keep remaining list of issues or ideas for the wiki in [2]. Enjoy! [1] https://github.com/freeipa/freeipa-wiki/issues/2 [2] https://github.com/freeipa/freeipa-wiki/issues -- Martin Kosek <mkosek(a)redhat.com> Manager, Software Engineering - Identity Management Team Red Hat, Inc.

1 0

any reference for HA solution and backup /restore
by barrykfl＠gmail.com 23 Nov '17

23 Nov '17

Hi all: setup two servers replicas want make HA and backup / restore ..any where have reference especially backup / restore is necessary. Regards Barry

2 1

Is it possible to put all replicas in a LAN (use mesh VPN) and selectively expose some nodes to internet?
by James Swineson 23 Nov '17

23 Nov '17

Hi, I'm planning a FreeIPA fresh installation across multiple datacenters and offices. Concerned about the risk of DNS DDoS, I wanted to make most nodes in a mesh VPN so they can replicate without exposing ports to internet. However, I still need some services over internet. So can I set up every node just using IP addresses defined in VPN, but leave some nodes open on Internet? Will it work? Is there any hostname based check? And if it works, do I need to set up completely different 2 sets of DNS records used in LAN and WAN? Thanks, James Swineson

2 3

Re: Expired passwords and generating an OTP token
by Aaron Hicks 22 Nov '17

22 Nov '17

Hello the List, A couple of new things to this problem, when a user has an expired password and a valid OTP token, the password reset process is broken on all machines at the ssh prompt. Even the ones that do not require 2FA. Feedback so far form Sumit indicates this is incorrect behaviour. As an attempt to get around this, I've tried adding a permission to the helpdesk role that would allow them to manage OTP tokens. I'll submit another thread on that. Regards, Aaron From: Aaron Hicks [mailto:aaron.hicks@nesi.org.nz] Sent: Thursday, 23 November 2017 6:31 AM To: Sumit Bose <sbose(a)redhat.com> Cc: 'FreeIPA users list' <freeipa-users(a)lists.fedorahosted.org>; 'Sumit Bose' <sbose(a)redhat.com> Subject: Re: [Freeipa-users] Re: Expired passwords and generating an OTP token Hi Sumit, I sent those to you directly as I wasn't comfortable posting them to the list. Regards, Aaron Get Outlook for iOS <https://aka.ms/o0ukef> _____ From: Sumit Bose <sbose(a)redhat.com <mailto:sbose@redhat.com> > Sent: Wednesday, November 22, 2017 10:19:34 PM To: Aaron Hicks Cc: 'FreeIPA users list'; 'Sumit Bose' Subject: Re: [Freeipa-users] Re: Expired passwords and generating an OTP token On Wed, Nov 22, 2017 at 09:21:52PM +1300, Aaron Hicks wrote: > Hi Sumit, > > Here is /etc/pam.d/password-auth I missed that it was an include, an that you wanted it too, again it's as installed bt CentOS 7.4 and ipa-client-install > ok, the PAM configuration looks good. Can you send me the PAM related messages form /var/log/secure or the journal which cover the failed attempt? And additionally the SSSD logs with debug_level=9 from the same time. Most important would be sssd_pam.log, sssd_domain.name.log and krb5_child-log. bye, Sumit

1 3

Re: Creating a permission to manage OTP Tokens
by Aaron Hicks 22 Nov '17

22 Nov '17

Sadly no, another person had been creating OTP tokens with the helpagent. These were tokens owned by the helpagent, but with other user's names. From: Aaron Hicks [mailto:aaron.hicks@nesi.org.nz] Sent: Thursday, 23 November 2017 4:00 PM To: 'freeipa-users(a)lists.fedorahosted.org' <freeipa-users(a)lists.fedorahosted.org> Subject: RE: Creating a permission to manage OTP Tokens Hello the list, After ignoring things, this now _works_ $kinit helpagent Password for helpagent(a)TEST.ORG <mailto:helpagent@TEST.ORG> : $ ipa otptoken-find -------------------- 2 OTP tokens matched -------------------- Unique ID: otpuser1 Type: TOTP Owner: otpuser1 Unique ID: otpuser2 Type: TOTP Owner: otpuser2 ---------------------------- Number of entries returned 2 ---------------------------- From: Aaron Hicks [mailto:aaron.hicks@nesi.org.nz] Sent: Thursday, 23 November 2017 10:45 AM To: 'freeipa-users(a)lists.fedorahosted.org' <freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> > Subject: Creating a permission to manage OTP Tokens Hello the list, We'd like to grant users with the helpdesk role the ability to manipulate other user's OTP tokens. The minimum would be to add them, delete them, and enable/disable them. This is currently possible if an admin sets a token's managedBy attribute to the helpdesk user's DN. We don't want to grant our helpdesk agents admin privileges. So, this is the permission I created: $ ipa permission-show 'Manage OTP Tokens' --all --raw dn: cn=Manage OTP Tokens,cn=permissions,cn=pbac,dc=test,dc=org cn: Manage OTP Tokens ipapermright: all ipapermincludedattr: ipatokenOwner ipapermincludedattr: ipatokenUniqueID ipapermincludedattr: ipatokenOTPdigits ipapermincludedattr: ipatokenOTPkey ipapermincludedattr: ipatokenTOTPclockOffset ipapermincludedattr: ipatokenTOTPtimeStep ipapermbindruletype: permission ipapermlocation: cn=otp,dc=test,dc=org ipapermtargetfilter: (objectclass=ipaToken) ipapermissiontype: SYSTEM ipapermissiontype: V2 aci: (targetattr = "ipatokenOTPdigits || ipatokenOTPkey || ipatokenOwner || ipatokenTOTPclockOffset || ipatokenTOTPtimeStep || ipatokenUniqueID")(targetfilter = "(objectclass=ipaToken)")(version 3.0;acl "permission:Manage OTP Tokens";allow (all) groupdn = "ldap:///cn=Manage OTP Tokens,cn=permissions,cn=pbac,dc=test,dc=org";) member: cn=Manage OTP Token,cn=privileges,cn=pbac,dc=test,dc=org memberindirect: cn=helpdesk,cn=roles,cn=accounts,dc=test,dc=org memberindirect: uid=helpagent,cn=users,cn=accounts,dc=test,dc=org objectclass: top objectclass: groupofnames objectclass: ipapermission objectclass: ipapermissionv2 However this does not work: $ kinit helpagent Password for helpagent(a)TEST.ORG <mailto:helpagent@TEST.ORG> : $ ipa otptoken-find -------------------- 0 OTP tokens matched -------------------- ---------------------------- Number of entries returned 0 Is there something happening in the back end preventing these permissions from workin? Any suggestions? Regards, Aaron

1 0

Re: Creating a permission to manage OTP Tokens
by Aaron Hicks 22 Nov '17

22 Nov '17

Hello the list, After ignoring things, this now _works_ $kinit helpagent Password for helpagent(a)TEST.ORG: $ ipa otptoken-find -------------------- 2 OTP tokens matched -------------------- Unique ID: otpuser1 Type: TOTP Owner: otpuser1 Unique ID: otpuser2 Type: TOTP Owner: otpuser2 ---------------------------- Number of entries returned 2 ---------------------------- From: Aaron Hicks [mailto:aaron.hicks@nesi.org.nz] Sent: Thursday, 23 November 2017 10:45 AM To: 'freeipa-users(a)lists.fedorahosted.org' <freeipa-users(a)lists.fedorahosted.org> Subject: Creating a permission to manage OTP Tokens Hello the list, We'd like to grant users with the helpdesk role the ability to manipulate other user's OTP tokens. The minimum would be to add them, delete them, and enable/disable them. This is currently possible if an admin sets a token's managedBy attribute to the helpdesk user's DN. We don't want to grant our helpdesk agents admin privileges. So, this is the permission I created: $ ipa permission-show 'Manage OTP Tokens' --all --raw dn: cn=Manage OTP Tokens,cn=permissions,cn=pbac,dc=test,dc=org cn: Manage OTP Tokens ipapermright: all ipapermincludedattr: ipatokenOwner ipapermincludedattr: ipatokenUniqueID ipapermincludedattr: ipatokenOTPdigits ipapermincludedattr: ipatokenOTPkey ipapermincludedattr: ipatokenTOTPclockOffset ipapermincludedattr: ipatokenTOTPtimeStep ipapermbindruletype: permission ipapermlocation: cn=otp,dc=test,dc=org ipapermtargetfilter: (objectclass=ipaToken) ipapermissiontype: SYSTEM ipapermissiontype: V2 aci: (targetattr = "ipatokenOTPdigits || ipatokenOTPkey || ipatokenOwner || ipatokenTOTPclockOffset || ipatokenTOTPtimeStep || ipatokenUniqueID")(targetfilter = "(objectclass=ipaToken)")(version 3.0;acl "permission:Manage OTP Tokens";allow (all) groupdn = "ldap:///cn=Manage OTP Tokens,cn=permissions,cn=pbac,dc=test,dc=org";) member: cn=Manage OTP Token,cn=privileges,cn=pbac,dc=test,dc=org memberindirect: cn=helpdesk,cn=roles,cn=accounts,dc=test,dc=org memberindirect: uid=helpagent,cn=users,cn=accounts,dc=test,dc=org objectclass: top objectclass: groupofnames objectclass: ipapermission objectclass: ipapermissionv2 However this does not work: $ kinit helpagent Password for helpagent(a)TEST.ORG <mailto:helpagent@TEST.ORG> : $ ipa otptoken-find -------------------- 0 OTP tokens matched -------------------- ---------------------------- Number of entries returned 0 Is there something happening in the back end preventing these permissions from workin? Any suggestions? Regards, Aaron

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2017