November 2017 - FreeIPA-users - Fedora mailing-lists

Creating a permission to manage OTP Tokens
by Aaron Hicks 22 Nov '17

22 Nov '17

Hello the list, We'd like to grant users with the helpdesk role the ability to manipulate other user's OTP tokens. The minimum would be to add them, delete them, and enable/disable them. This is currently possible if an admin sets a token's managedBy attribute to the helpdesk user's DN. We don't want to grant our helpdesk agents admin privileges. So, this is the permission I created: $ ipa permission-show 'Manage OTP Tokens' --all --raw dn: cn=Manage OTP Tokens,cn=permissions,cn=pbac,dc=test,dc=org cn: Manage OTP Tokens ipapermright: all ipapermincludedattr: ipatokenOwner ipapermincludedattr: ipatokenUniqueID ipapermincludedattr: ipatokenOTPdigits ipapermincludedattr: ipatokenOTPkey ipapermincludedattr: ipatokenTOTPclockOffset ipapermincludedattr: ipatokenTOTPtimeStep ipapermbindruletype: permission ipapermlocation: cn=otp,dc=test,dc=org ipapermtargetfilter: (objectclass=ipaToken) ipapermissiontype: SYSTEM ipapermissiontype: V2 aci: (targetattr = "ipatokenOTPdigits || ipatokenOTPkey || ipatokenOwner || ipatokenTOTPclockOffset || ipatokenTOTPtimeStep || ipatokenUniqueID")(targetfilter = "(objectclass=ipaToken)")(version 3.0;acl "permission:Manage OTP Tokens";allow (all) groupdn = "ldap:///cn=Manage OTP Tokens,cn=permissions,cn=pbac,dc=test,dc=org";) member: cn=Manage OTP Token,cn=privileges,cn=pbac,dc=test,dc=org memberindirect: cn=helpdesk,cn=roles,cn=accounts,dc=test,dc=org memberindirect: uid=helpagent,cn=users,cn=accounts,dc=test,dc=org objectclass: top objectclass: groupofnames objectclass: ipapermission objectclass: ipapermissionv2 However this does not work: $ kinit helpagent Password for helpagent(a)TEST.ORG: $ ipa otptoken-find -------------------- 0 OTP tokens matched -------------------- ---------------------------- Number of entries returned 0 Is there something happening in the back end preventing these permissions from workin? Any suggestions? Regards, Aaron

1 0

Re: Expired passwords and generating an OTP token
by Aaron Hicks 22 Nov '17

22 Nov '17

Hello the List, This turned out to be a workflow issue, we still have a problem but this first use case works. In the case of a user with an invalid password (none or expired) with no OTP token they can reset their password and ask IPA to create an OTP token for them. 1. Helpdesk agent uses FreeIPA API passwd method to issue a temporary password and pass it to the user 2. User uses ssh to login to 2FA host 3. SSH forces user through the reset password process and closes connection 4. User is not able to login without a OTP Token. A correct result. 5. User uses FreeIPA API otptoken-add method with new password to generate & receive OTP token 6. User is now able to SSH with password + OTP token. What isn't working is the case where a user has an invalid token (non, expired, or just reset) and a valid OTP token. 1. (Optional, but puts user into required state) Helpdesk agent uses FreeIPA API passwd method to issue a temporary password and pass it to the user 2. User uses ssh to login to 2FA host, which asks for temporary password. 3. SSH forces user through reser password process and closes connection. 4. User is now able to SSH with password + OTP poken In this case step 2 fails. The reset password process looks like this: login as: username Using keyboard-interactive authentication. Password: Access denied Using keyboard-interactive authentication. Password: Using keyboard-interactive authentication. Password expired. Change your password now. Current Password: Access denied The change password process fails. However, if we disable or delete their OTP token (which requires FreeIPA admin, not helpdesk role) they're able to reset their password. We don't want to have to give admin rights to the helpdesk agent for this. This is also complicated by that the FreeIPA API changes behaviour: * With an expired/password user can not connect to the API, even to do passwd to reset password * With an OTP token, users have to use passwordOTPCODE to access the API, which means they can't manage their otptoken if they've lost it or want to disable it so they can reset their password because they forgot it, or delete it. Is there a way of allowing users in the helpdesk group/role to be able to disable/enable or delete OTP tokens? They don't need to see the content, just allow users to restart the password and token request process. Is there a fix for the above workflow to allow a user with an OTP token to reset their password? Regards, Aaron Hicks From: Aaron Hicks [mailto:aaron.hicks@nesi.org.nz] Sent: Tuesday, 21 November 2017 6:22 PM To: freeipa-users(a)lists.fedorahosted.org Subject: Expired passwords and generating an OTP token Hello the list, I think this is the last thing to make our terrible user management model work. With a helpdesk role via the REST API we can reset a users password, which is expired, because this is the right thing to do. These users are expected to log into a node with 2FA using an OTP token generated by FreeIPA. This works if a user has a valid password and a token. This is the only machine they have access to, as it's they lander node. They can not reach the FreeIPA web interface. They can use the FreeIPA API via our customer management system (CMS) either as them self or as a helpdek agent on their behalf. The CMS auth is SAML via federated shibboleth, so does not use our FreeIPA credentials. However, we have few use cases we need to work: Can a user generate an OTP token when their password is expired? Can a a user reset their password when they do not have an OTP token? Can a user reset their password when they can't log in to get the secret from thier OTP token? I think the shortest routes would be: - if a user could reset an expired password via the FreeIPA API, then use the otptoken_add method to create one all via our CMS. - if a user could reset thier password at the ssh login prompt if they have no token or don't have thier token. Then add a token via our CMS. Regards, Aaron Get Outlook for iOS <https://aka.ms/o0ukef>

2 5

Re: FreeIPA-users Digest, Vol 7, Issue 22
by Николай Савельев 22 Nov '17

22 Nov '17

> > I think the better reference in the documentation is > https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… > > If there is a trust to an AD forest and 'ipa-adtrust-install > --enable-compat' was called. there will be a special sub-tree in > FreeIPA's LDAP tree cn=compat,dc=ipa,dc=domain. AD user can be searched > in this sub-tree and if the user was found you can the the DN of the > user to bind to FreeIPA's LDAP server with the AD password. > > Btw, I guess Owncloud supports PAM authentication as well, in this case > you can just configure Owncloud's PAM module to use SSSD on an IPA > client and SSSD will do the authentication of AD users for you. > > HTH > > bye, > Sumit > >> rob I did 'ipa-adtrust-install --enable-compat' But in cn=compat,dc=test,dc=loc are only IPA users How can I insert AD users in cn=compat,dc=test,dc=loc? -- С уважением, Николай.

2 2

Re: Expired passwords and generating an OTP token
by Aaron Hicks 21 Nov '17

21 Nov '17

Hi the list. .I'd consider createing a permission with permission-add, but there is no token object type. [hicksaw@hpch2fa02 ~]$ ipa permission-add mangage-otptoken --right=all --bindtype=permission --type=token ipa: ERROR: invalid 'type': "token" is not an object type Even though ipatoken is a valid objectclass Regards, Aaron From: Aaron Hicks [mailto:aaron.hicks@nesi.org.nz] Sent: Wednesday, 22 November 2017 5:16 PM To: 'freeipa-users(a)lists.fedorahosted.org' <freeipa-users(a)lists.fedorahosted.org> Subject: RE: Expired passwords and generating an OTP token Hello the List, This turned out to be a workflow issue, we still have a problem but this first use case works. In the case of a user with an invalid password (none or expired) with no OTP token they can reset their password and ask IPA to create an OTP token for them. 1. Helpdesk agent uses FreeIPA API passwd method to issue a temporary password and pass it to the user 2. User uses ssh to login to 2FA host 3. SSH forces user through the reset password process and closes connection 4. User is not able to login without a OTP Token. A correct result. 5. User uses FreeIPA API otptoken-add method with new password to generate & receive OTP token 6. User is now able to SSH with password + OTP token. What isn't working is the case where a user has an invalid token (non, expired, or just reset) and a valid OTP token. 1. (Optional, but puts user into required state) Helpdesk agent uses FreeIPA API passwd method to issue a temporary password and pass it to the user 2. User uses ssh to login to 2FA host, which asks for temporary password. 3. SSH forces user through reser password process and closes connection. 4. User is now able to SSH with password + OTP poken In this case step 2 fails. The reset password process looks like this: login as: username Using keyboard-interactive authentication. Password: Access denied Using keyboard-interactive authentication. Password: Using keyboard-interactive authentication. Password expired. Change your password now. Current Password: Access denied The change password process fails. However, if we disable or delete their OTP token (which requires FreeIPA admin, not helpdesk role) they're able to reset their password. We don't want to have to give admin rights to the helpdesk agent for this. This is also complicated by that the FreeIPA API changes behaviour: * With an expired/password user can not connect to the API, even to do passwd to reset password * With an OTP token, users have to use passwordOTPCODE to access the API, which means they can't manage their otptoken if they've lost it or want to disable it so they can reset their password because they forgot it, or delete it. Is there a way of allowing users in the helpdesk group/role to be able to disable/enable or delete OTP tokens? They don't need to see the content, just allow users to restart the password and token request process. Is there a fix for the above workflow to allow a user with an OTP token to reset their password? Regards, Aaron Hicks From: Aaron Hicks [mailto:aaron.hicks@nesi.org.nz] Sent: Tuesday, 21 November 2017 6:22 PM To: freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> Subject: Expired passwords and generating an OTP token Hello the list, I think this is the last thing to make our terrible user management model work. With a helpdesk role via the REST API we can reset a users password, which is expired, because this is the right thing to do. These users are expected to log into a node with 2FA using an OTP token generated by FreeIPA. This works if a user has a valid password and a token. This is the only machine they have access to, as it's they lander node. They can not reach the FreeIPA web interface. They can use the FreeIPA API via our customer management system (CMS) either as them self or as a helpdek agent on their behalf. The CMS auth is SAML via federated shibboleth, so does not use our FreeIPA credentials. However, we have few use cases we need to work: Can a user generate an OTP token when their password is expired? Can a a user reset their password when they do not have an OTP token? Can a user reset their password when they can't log in to get the secret from thier OTP token? I think the shortest routes would be: - if a user could reset an expired password via the FreeIPA API, then use the otptoken_add method to create one all via our CMS. - if a user could reset thier password at the ssh login prompt if they have no token or don't have thier token. Then add a token via our CMS. Regards, Aaron Get Outlook for iOS <https://aka.ms/o0ukef>

1 0

adding puppet to FreeIPA
by Andrew Meyer 21 Nov '17

21 Nov '17

Ok now I am trying to add puppet to my FreeIPA environment. Following the instructions from: https://www.freeipa.org/page/Howto/Using_FreeIPA_CA_for_Puppet I am getting the following error: [root@asm-automation01 ~]# ipa service-add puppetmaster/asm-automation01.mgt.asm.borg.localipa: ERROR: Host 'asm-automation01.mgt.asm.borg.local' does not have corresponding DNS A/AAAA record[root@asm-automation01 ~]# ipa service-add puppetmaster/asm-automation01.mgt.asm.borg.local --forceipa: ERROR: service with name "puppetmaster/asm-automation01.mgt.asm.borg.local(a)MEYER.LOCAL" already exists[root@asm-automation01 ~]# sudo vi /etc/puppetlabs/puppet/puppet.conf[root@asm-automation01 ~]# ipa-getcert request -K puppetmaster/asm-automation01.mgt.asm.borg.local -d /etc/httpd/alias -n puppetmaster/asm-automation01.mgt.asm.borg.localCertificate at same location is already used by request with nickname "20171116140630".[root@asm-automation01 ~]# puppet master --configprint hostcert /var/lib/puppet/ssl/certs/asm-automation01.mgt.asm.borg.local.pem/etc/puppetlabs/puppet/ssl/certs/asm-automation01.mgt.asm.borg.local.pem[root@asm-automation01 ~]# puppet master --configprint hostprivkey /var/lib/puppet/ssl/private_keys/asm-automation01.mgt.asm.borg.local.pem/etc/puppetlabs/puppet/ssl/private_keys/asm-automation01.mgt.asm.borg.local.pem[root@asm-automation01 ~]# puppet master --configprint localcacert /var/lib/puppet/ssl/certs/ca.pem/etc/puppetlabs/puppet/ssl/certs/ca.pem [root@asm-automation01 ~]# certutil -L -d /etc/pki/nssdb -a -n "IPA Machine Certificate - asm-automation01.mgt.asm.borg.local" > /var/lib/puppet/ssl/certs/asm-automation01.mgt.asm.borg.localcertutil: Could not find cert: IPA Machine Certificate - asm-automation01.mgt.asm.borg.local: PR_FILE_NOT_FOUND_ERROR: File not found[root@asm-automation01 ~]# puppet master --configprint localcacert /var/lib/puppet/ssl/certs/ca.pem/etc/puppetlabs/puppet/ssl/certs/ca.pem[root@asm-automation01 ~]# certutil -L -d /etc/pki/nssdb -a -n "IPA Machine Certificate - asm-automation01.mgt.asm.borg.local" > /var/lib/puppet/ssl/certs/asm-automation01.mgt.asm.borg.localcertutil: Could not find cert: IPA Machine Certificate - asm-automation01.mgt.asm.borg.local: PR_FILE_NOT_FOUND_ERROR: File not found[root@asm-automation01 ~]# Trying to figure out if my syntax is off. I've created the folders in /var/lib/puppet/ssl/certs. Thank you,

2 2

DNS fails to reply the ipa zone records
by Raul Dias 21 Nov '17

21 Nov '17

Bind seems to work fine. When queried about a record it logs the answer fine (even for external domains). However it fails to answer any ipa local zone request. e.g. resolve it own host query: ------------------------------ 8< -------------------------- 21-Nov-2017 13:52:06.419 client: debug 3: client 127.0.0.1#58281: UDP request 21-Nov-2017 13:52:06.419 security: debug 3: client 127.0.0.1#58281: request is not signed 21-Nov-2017 13:52:06.419 security: debug 3: client 127.0.0.1#58281: recursion available 21-Nov-2017 13:52:06.419 client: debug 3: client 127.0.0.1#58281: query 21-Nov-2017 13:52:06.420 queries: info: client 127.0.0.1#58281 (freeipa.base.foo.com): query: freeipa.base.foo.com IN A +E (10.10.24.9) 21-Nov-2017 13:52:06.420 security: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): query (cache) 'freeipa.base.foo.com/A/IN' approved 21-Nov-2017 13:52:06.420 client: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): send 21-Nov-2017 13:52:06.420 client: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): sendto 21-Nov-2017 13:52:06.420 client: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): senddone 21-Nov-2017 13:52:06.420 client: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): next 21-Nov-2017 13:52:06.420 client: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): endrequest ---------------------- >8 -------------------------------- $ dig @localhost freeipa.base.foo.com ; <<>> DiG 9.11.1-P3-RedHat-9.11.1-8.P3.fc27 <<>> @localhost freeipa.base.foo.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 16172 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: 5c26280e126505660dd1745d5a145292345cd82b68103795 (good) ;; QUESTION SECTION: ;freeipa.base.foo.com. IN A ;; Query time: 2190 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue Nov 21 16:21:38 UTC 2017 ;; MSG SIZE rcvd: 83 ------------------------------ 8< -------------------------- It only happens to the ldap records. So, what can I do to debug this further? -rsd

1 0

Invalid ticket for NFS4 mount
by Ray 21 Nov '17

21 Nov '17

Hi, yesterday I noticed a strange issue on a Centos 7 client running ipa-client-4.5.0-21.el7.centos.2.2.x86_64: My daughter tried to log in to the machine and was kicked out again after GNOME failed to load (/home on kerberized NFS4). Closer inspection showed that she had no permission to access her home directory, so GNOME was unable to read its settings. This worked before. I asked her to log into a text console. She got / as her home directory, as again, she was unable to access her actual home directory. I checked with klist that she got a ticket. All seemed fine there (TGT present). Tried 'cd' again: Permission denied. Then I asked her to kinit once more. She hacken in her password again and got a new ticket. Tried 'cd' again, et voila!: It cding to her NFS4 home directory worked immediately. Questions: - What could be the reason for this behaviour? The box was freshly booted and I don't see what might have been wrong with the first ticket. - Where should I look (which logs, etc.) to investigate this further? Regards, Ray

2 5

Autentification in application with freeipa
by Николай Савельев 21 Nov '17

21 Nov '17

Hi. I asked about Owncloud, Zimbra, etc autentification in freeipa with AD trust. I was offered to use SAML. But I dont undestand SAML. It very dificult for me. I only want use LDAP for autentification as in this artikle https://www.freeipa.org/page/Owncloud_Authentication_against_FreeIPA Or this https://www.freeipa.org/page/Zimbra_Collaboration_Server_7.2_Authentication… Articles work fine but only for freeipa users. It dont work for AD users from trusted domain. I found Red Hat documentation for sinchronising AD with IPA https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… If i do it i can see AD user in ldap requests for ipa server? -- С уважением, Николай.

3 2

Re: Enabling two-factor by host
by Sumit Bose 21 Nov '17

21 Nov '17

On Fri, Nov 17, 2017 at 04:09:01AM +0000, Aaron Hicks via FreeIPA-users wrote: > Hello the list, > > Is it possible to enable two-factor authentication using Google Authenticator on FreeIPA on specific hosts or groups of hosts? > > Alternatively, are there any recommendations on modifying the Pam configuration on these 2FA required machines to grab the OTP token from FreeIPA when a user logs in? Please check if authentication indicators is waht you are looking for, see e.g. https://blog.delouw.ch/2016/10/16/freeipa-selective-2fa-authentication-indi… for details, look especially for 'Enforcing 2FA on a host principal'. HTH bye, Sumit > > Regards, > > Aaron > > Get Outlook for iOS<https://aka.ms/o0ukef> > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org

2 7

Unexpected ipa usa behaviour
by Ronald Wimmer 21 Nov '17

21 Nov '17

Hi, in IPA I defined a user called isomeuser. This username does definitely not exist on the AD side. When I log in as root to an IPA client and issue the su command, I am isomeuser(a)ad.domain. If I do "su isomeuser(a)ipa.domain" I am isomeuser(a)ad.domain. The uid and gid are exactly the same. Why can I be isomeuser(a)ad.domain if that user does not exist? Regards, Ronald

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2017