December 2017 - FreeIPA-users - Fedora mailing-lists

Fedroa 26 to 27 - FreeIpa upgrade failed on ARM
by Winfried de Heiden 26 Dec '17

26 Dec '17

2 1

Web UI login fails after upgrading to 4.5
by Marius Bjørnstad 24 Dec '17

24 Dec '17

Hi all, After I upgraded to FreeIPA 4.5 (on CentOS 7), I get an error "Login failed due to an unknown reason" on the web UI, no matter if I use the admin user or my personal user. From what I can tell, all the ipa commands work fine on the command line, and kinit also works fine. I have included some output from /var/log/httpd/error_log below. It would be great if someone could make a guess (or better) at what is going wrong, or which logs to look at, etc. When I run the command in the CalledProcessError, I get a password prompt for WELLKNOWN/ANONYMOUS(a)OUS.NSC.LOCAL (the second part is the realm name). Thanks, Marius [Thu Oct 05 11:36:34.898930 2017] [core:notice] [pid 7417] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0 [Thu Oct 05 11:36:34.899649 2017] [suexec:notice] [pid 7417] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) [Thu Oct 05 11:36:34.899669 2017] [:warn] [pid 7417] NSSSessionCacheTimeout is deprecated. Ignoring. [Thu Oct 05 11:36:35.065273 2017] [auth_digest:notice] [pid 7417] AH01757: generating secret for digest authentication ... [Thu Oct 05 11:36:35.065933 2017] [lbmethod_heartbeat:notice] [pid 7417] AH02282: No slotmem from mod_heartmonitor [Thu Oct 05 11:36:35.065947 2017] [:warn] [pid 7417] NSSSessionCacheTimeout is deprecated. Ignoring. [Thu Oct 05 11:36:35.100828 2017] [mpm_prefork:notice] [pid 7417] AH00163: Apache/2.4.6 (CentOS) mod_auth_gssapi/1.5.1 mod_nss/1.0.14 NSS/3.28.4 PHP/5.4.16 mod_wsgi/3.4 Python/2.7.5 configured -- resuming normal operations [Thu Oct 05 11:36:35.100849 2017] [core:notice] [pid 7417] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND' [Thu Oct 05 11:36:36.676629 2017] [:error] [pid 7424] ipa: INFO: *** PROCESS START *** [Thu Oct 05 11:36:36.695362 2017] [:error] [pid 7425] ipa: INFO: *** PROCESS START *** --- login attempt performed now --- [Thu Oct 05 11:36:38.504718 2017] [:error] [pid 7424] [remote 192.168.1.48:244] mod_wsgi (pid=7424): Exception occurred processing WSGI script '/usr/share/ipa/wsgi.py'. [Thu Oct 05 11:36:38.504758 2017] [:error] [pid 7424] [remote 192.168.1.48:244] Traceback (most recent call last): [Thu Oct 05 11:36:38.504776 2017] [:error] [pid 7424] [remote 192.168.1.48:244] File "/usr/share/ipa/wsgi.py", line 51, in application [Thu Oct 05 11:36:38.504845 2017] [:error] [pid 7424] [remote 192.168.1.48:244] return api.Backend.wsgi_dispatch(environ, start_response) [Thu Oct 05 11:36:38.504855 2017] [:error] [pid 7424] [remote 192.168.1.48:244] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 262, in __call__ [Thu Oct 05 11:36:38.505045 2017] [:error] [pid 7424] [remote 192.168.1.48:244] return self.route(environ, start_response) [Thu Oct 05 11:36:38.505054 2017] [:error] [pid 7424] [remote 192.168.1.48:244] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 274, in route [Thu Oct 05 11:36:38.505067 2017] [:error] [pid 7424] [remote 192.168.1.48:244] return app(environ, start_response) [Thu Oct 05 11:36:38.505072 2017] [:error] [pid 7424] [remote 192.168.1.48:244] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 929, in __call__ [Thu Oct 05 11:36:38.505079 2017] [:error] [pid 7424] [remote 192.168.1.48:244] self.kinit(user_principal, password, ipa_ccache_name) [Thu Oct 05 11:36:38.505083 2017] [:error] [pid 7424] [remote 192.168.1.48:244] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 965, in kinit [Thu Oct 05 11:36:38.505089 2017] [:error] [pid 7424] [remote 192.168.1.48:244] pkinit_anchors=[paths.KDC_CERT, paths.KDC_CA_BUNDLE_PEM], [Thu Oct 05 11:36:38.505094 2017] [:error] [pid 7424] [remote 192.168.1.48:244] File "/usr/lib/python2.7/site-packages/ipalib/install/kinit.py", line 125, in kinit_armor [Thu Oct 05 11:36:38.505135 2017] [:error] [pid 7424] [remote 192.168.1.48:244] run(args, env=env, raiseonerr=True, capture_error=True) [Thu Oct 05 11:36:38.505143 2017] [:error] [pid 7424] [remote 192.168.1.48:244] File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 511, in run [Thu Oct 05 11:36:38.505346 2017] [:error] [pid 7424] [remote 192.168.1.48:244] raise CalledProcessError(p.returncode, arg_string, str(output)) [Thu Oct 05 11:36:38.505372 2017] [:error] [pid 7424] [remote 192.168.1.48:244] CalledProcessError: Command '/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_7424 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem' returned non-zero exit status 1

3 11

sudo auth doesn't work on some hosts
by Andrew Radygin 22 Dec '17

22 Dec '17

Hello! I've got interesting problem, I have very simple hbac and sudo rules, one hbac for admins group and the same sudo rule for the same user group - all members of this group could do anything and everywhere. I cannot do sudo on some of machines, it's just doesn't accepting password, but initial login via ssh always successful. There is no different between hosts where sudo working and where is not, for freeIPA. audit log tells me why it's happening: ========= type=USER_AUTH msg=audit(1512995488.051:15986): pid=30997 uid=50019 auid=50019 ses=2221 msg='op=PAM:authentication grantors=? acct="andreios" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=failed' type=USER_AUTH msg=audit(1512995497.531:15987): pid=30997 uid=50019 auid=50019 ses=2221 msg='op=PAM:authentication grantors=? acct="andreios" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=failed' type=USER_AUTH msg=audit(1512995500.247:15988): pid=30997 uid=50019 auid=50019 ses=2221 msg='op=PAM:authentication grantors=? acct="andreios" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=failed' ========== You see? op=PAM:authentication grantors=? On the other hosts it's following: op=PAM:authentication grantors=pam_succeed_if,pam_succeed_if,pam_sss Obviously, sudo for whatever reason doesn't try to auth via pam modules, it's just doesn't seeing them. sudo debug doesn't tell anything useful: ============ Dec 11 16:22:28 sudo[31666] -> getln @ ./tgetpass.c:303 Dec 11 16:22:33 sudo[31666] <- getln @ ./tgetpass.c:346 := ********** Dec 11 16:22:33 sudo[31666] -> sudo_term_restore_v1 @ ./term.c:112 Dec 11 16:22:33 sudo[31666] <- sudo_term_restore_v1 @ ./term.c:120 := true Dec 11 16:22:33 sudo[31666] <- tgetpass @ ./tgetpass.c:231 := ********** Dec 11 16:22:35 sudo[31666] -> tgetpass @ ./tgetpass.c:93 Dec 11 16:22:35 sudo[31666] -> tty_present @ ./tgetpass.c:360 Dec 11 16:22:35 sudo[31666] <- tty_present @ ./tgetpass.c:361 := true Dec 11 16:22:35 sudo[31666] -> sudo_term_noecho_v1 @ ./term.c:130 Dec 11 16:22:35 sudo[31666] <- sudo_term_noecho_v1 @ ./term.c:141 := true Dec 11 16:22:35 sudo[31666] -> getln @ ./tgetpass.c:303 ============ freeipa client installed via ipa-client-install without any errors OS: Centos 7.3.1611 OS without problems: 7.4.1708, 7.2.1511 So, have anyone idea of what's going happening and why? Thanks! -- Best regards, Andrew.

1 2

api scripts
by Andrew Meyer 21 Dec '17

21 Dec '17

Does anyone have any examples or could share what they have written? I am trying to write a script and not sure what components I need.

2 1

User login is slow to get password prompt
by Alexandre Pitre 20 Dec '17

20 Dec '17

Hi, While troubleshooting "slow login" with ipa users we discovered that adding these two lines to our clients sssd.conf file fixed our issue for ipa users. ldap_search_base = cn=accounts,dc=ipa,dc=domain,dc=com ldap_user_search_base = cn=users,cn=accounts,dc=ipa,dc=domain,dc=com On the freeipa server side's sssd, we also added, based on the performance tuning blog post https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-large-…, these two parameters. ignore_group_members = True subdomain_inherit = ignore_group_members Without these options and sssd debug enabled, we can see that it goes through all the trusted AD group to request membership(I think). Here's a log entry example: (Mon Dec 18 23:50:49 2017) [sssd[be[ipa.domain.com]]] [ipa_s2n_get_list_next] (0x0400): Received [testgroup(a)domain.com] attributes from IPA server. (Mon Dec 18 23:50:49 2017) [sssd[be[ipa.domain.com]]] [ipa_s2n_save_objects] (0x0400): Processing group testgroup(a)domain.com (Mon Dec 18 23:50:49 2017) [sssd[be[ipa.domain.com]]] [sysdb_search_by_name] (0x0400): No such entry (Mon Dec 18 23:50:49 2017) [sssd[be[ipa.domain.com]]] [sysdb_search_by_name] (0x0400): No such entry (Mon Dec 18 23:50:49 2017) [sssd[be[ipa.domain.com]]] [sysdb_search_group_by_gid] (0x0400): No such entry Should ldap_search_base and lda_user_seach_base parameters should be in our clients sssd per default ? Is that a normal behavior ? We're also experiencing similar login slowness with our AD trusted credentials. Do similar parameters exist for a trusted AD realm ? Thanks for your help. -- Alexandre Pitre alexandre.pitre(a)gmail.com

2 3

How to deal with 'su root'
by Ronald Wimmer 19 Dec '17

19 Dec '17

We have some users that have ALL sudo permissions. What is the best way of keeping track of all actions they do after having switched to the root user? Or would it be better to completely prevent switching to the root user? (if yes, what would be the recommended way of doing that?) Regards, Ronald

4 4

retrieve user keytab from multiple hosts
by Stijn De Weirdt 16 Dec '17

16 Dec '17

hi all, i'm trying to retrieve an existing keytab from a user on a second host. ipa-getkeytab on a first host worked fine. but when i try to retrieve the keytab (using -r option) i get a "Insufficient access rights" error (even when using admin credentials) i looked into "ipa service-allow-retrieve-keytab", but it does not accept the user principal (pretty normal since it's not a service i guess). hints welcome! stijn

2 2

Unable to use externa groups or users, truster domain object not found
by Henrik Stigendal 15 Dec '17

15 Dec '17

Hello everyone, I’m new to this and are trying to setup a working trust against an AD forrest, I seem to have a working trust but when I try to reference external groups (or users) I get: # ipa group-add-member ad_users_external --external "AD2\Domain Users" [member user]: [member group]: Group name: ad_users_external Description: AD users external map Failed members: member user: member group: AD2\Domain Users: trusted domain object not found ------------------------- Number of members added 0 ------------------------- I enable some logging and last in the mail is the output there from the command above, any suggestions what could cause this? Current version of IPA is 4.5. Regards Henrik Tue Nov 21 13:10:42.675713 2017] [:warn] [pid 38221] [client 192.168.6.82:34714] failed to set perms (3140) on file (/var/run/ipa/ccaches/admin(a)IDM.TEST.NET)!, referer: https://ipaserver.idm.test.net/ipa/xml string_to_sid: SID AD2\Domain Users is not in a valid format lpcfg_load: refreshing parameters from /usr/share/ipa/smb.conf.empty Processing section "[global]" INFO: Current debug levels: all: 11 tdb: 11 printdrivers: 11 lanman: 11 smb: 11 rpc_parse: 11 rpc_srv: 11 rpc_cli: 11 passdb: 11 sam: 11 auth: 11 winbind: 11 vfs: 11 idmap: 11 quota: 11 acls: 11 locking: 11 msdfs: 11 dmapi: 11 registry: 11 scavenger: 11 dns: 11 ldb: 11 tevent: 11 pm_process() returned Yes added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255 netmask=255.255.255.0 added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255 netmask=255.255.255.0 added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255 netmask=255.255.255.0 added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255 netmask=255.255.255.0 added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255 netmask=255.255.255.0 added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255 netmask=255.255.255.0 added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255 netmask=255.255.255.0 added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255 netmask=255.255.255.0 finddcs: searching for a DC by DNS domain ad2.test.net finddcs: looking for SRV records for _ldap._tcp.ad2.test.net resolve_lmhosts: Attempting lmhosts lookup for name _ldap._tcp.ad2.test.net<0x0> getlmhostsent: lmhost entry: 127.0.0.1 localhost ads_dns_lookup_srv: 2 records returned in the answer section. ads_dns_parse_rr_srv: Parsed adserver.ad2.test.net [0, 100, 389] ads_dns_parse_rr_srv: Parsed adserver.ad2.test.net [0, 100, 389] Addrs = 192.168.5.158@389/adserver,192.168.5.104@389/adserver finddcs: DNS SRV response 0 at '192.168.5.158' finddcs: DNS SRV response 1 at '192.168.5.104' finddcs: performing CLDAP query on 192.168.5.158 &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 63c3a477-85f9-5f01-96e8-2597a5c48978 forest : 'ad2.test.net' dns_domain : 'ad2.test.net' pdc_dns_name : 'adserver.ad2.test.net' domain_name : 'AD2' pdc_name : 'adserver' user_name : '' server_site : 'AS001' client_site : 'AS002' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) finddcs: Found matching DC 192.168.5.158 with server_type=0x0001f1fc [Tue Nov 21 13:10:42.740320 2017] [:error] [pid 26496] ipa: INFO: [jsonserver_session] admin(a)IDM.TEST.NET: group_add_member/1(u'ad_users_external', ipaexternalmember=(u'AD2\\\\Domain Users',), version=u'2.228'): SUCCESS

4 9

Freeipa connecting to Redhat IPA server.
by Tony Delov 15 Dec '17

15 Dec '17

I've been having difficulties connecting a freeipa-client on Ubuntu 16.06 LTS, to a Redhat IPA server that has a trusted connection to Microsoft AD server. Ssh authentications are pretty slow, however, once I do get on, I find sudo commands often do not work for several minutes saying I am not in the "not in the sudoers file.". This is even though, I am in the same group on the access.conf file and a sudoers file. I think the initial slowness is due to the fact that our AD system has lots of groups and I am part of many large groups with many users. I've been checking the sssd cache file, and I can see that ssh authentication does not even start until almost all groups I am a member of have been added to the cache. However, that does not explain why sudo is being delayed as the groups are already cached. Has anyone got any advice about setting up a freeipa-client on Ubuntu to connect to a Redhat IPA server? Has anyone else experienced difficulties with sudo commands? Group membership not listing all the groups a person is a member off all the time. id <username> *IPA Client.* DISTRIB_ID=Ubuntu DISTRIB_RELEASE=16.04 DISTRIB_CODENAME=xenial DISTRIB_DESCRIPTION="Ubuntu 16.04.3 LTS" # dpkg --list | grep freeipa ii freeipa-client 4.3.1-0ubuntu1 amd64 FreeIPA centralized identity framework -- client ii freeipa-common 4.3.1-0ubuntu1 all FreeIPA centralized identity framework -- common files *IPA Server* # cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.4 (Maipo) # rpm -qa | grep "ipa-" sssd-ipa-1.15.2-50.el7_4.6.x86_64 ipa-common-4.5.0-21.el7_4.2.2.noarch ipa-server-4.5.0-21.el7_4.2.2.x86_64 ipa-client-common-4.5.0-21.el7_4.2.2.noarch ipa-client-4.5.0-21.el7_4.2.2.x86_64 ipa-server-common-4.5.0-21.el7_4.2.2.noarch ipa-server-trust-ad-4.5.0-21.el7_4.2.2.x86_64 Regards Tony D

4 3

Replica setup options
by Gordon Messmer 15 Dec '17

15 Dec '17

I've set up a replica in an IPA domain, and was surprised that it did not have DNS configured the same way that the first IPA server does. Of the following options that I specified on the first install, which do I need to provide to a replica in order to get identical functionality, and where is that documented? --mkhomedir --setup-dns --forwarder --reverse-zone --allow-zone-overlap --setup-adtrust

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users December 2017