FreeIPA-users April 2018

freeipa-users@lists.fedorahosted.org

54 participants
78 discussions

Re: Obtain TGT at login.
by Alexander Bokovoy 04 Apr '18

04 Apr '18

Don't drop the mailing list, please. On ke, 04 huhti 2018, Michael Rainey (Contractor, Code 7320) wrote: >I'm talking about Kerberos. Logging into the system is not an issue. >How do I obtain a Ticket Granting Ticket (TGT) without having to >execute "kinit" and enter a password. > >Once I log into my workstation, via console or graphical environment, >I should have my kerberos credentials created or renewed and ready to >use on my network. As it works currently, I log into my system, I >open a terminal, run kinit and enter a password. Is it possible to >configure my system to obtain my kerberos credentials without needing >a password once I am successfully logged into my workstation? This doesn't help either. Unless you changed SSSD configuration, a default one on IPA clients should populate your credentials cache. That's why I'm asking for more details because without them it is literally not possible to provide you any guidance. A generic SSSD troubleshooting can be found here: https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html >On 04/04/2018 11:20 AM, Alexander Bokovoy via FreeIPA-users wrote: >>On ke, 04 huhti 2018, Michael Rainey (Contractor, Code 7320) via >>FreeIPA-users wrote: >>>Greetings, >>> >>>My organization is working to remove the need for passwords for >>>its end-users. While moving forward on this project I have >>>noticed after logging into a system the user is never given a TGT >>>after login. A TGT can be obtained by using kinit and entering a >>>password, but this defeats the purpose eliminating the use of >>>passwords. Is there some guidance I can follow to configure >>>freeIPA to obtain a TGT at login. So farmy searches have come up >>>empty. >>> >>>Is this type of configuration handled by SSSD or do I need to >>>configure kerberos? >>> >>>Any guidance is greatly appreciated. >>What type of a login do you talk about? SSH access, console login, using >>graphical environment, etc? >> >>Login without password is possible to achieve multiple ways. Which one >>is in use here? >>A bit more details on what is the workflow in use would help. >> > -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

ipareplica role
by Thomas Woerner 04 Apr '18

04 Apr '18

Hello, the ipareplica role just landed in the ansible-freeipa repo at https://github.com/freeipa/ansible-freeipa There are example playbooks for installation and uninstallation of replica with (un)install-replica and (un)install-cluster. In the inventory directory there are example inventory files hosts.replica and hosts.cluster. The support for external cert files is not complete yet. More docs are on the way to hit the repo soon. Regards, Thomas

1 0

How freeIPA saved the day on AWS EC2 ...
by Chris Dagdigian 04 Apr '18

04 Apr '18

FreeIPA with AD integration inside an AWS VPC took what was going to be a 60-minute downtime on a production server and let me solve the issue in about 60 seconds ... Story below: One of the great things about moving a company to AWS is that I can usually delegate far more administrative powers to the end-users and developers than they are used to having on-premise or coming out of a managed services environment. The downside to this power is that sometimes people accidentally do inconvenient things like break /etc/sudoers file on an EC2 node And since the usual best practice for secure AWS operations is: - SSH with keys only (no passwords - Sudo rules that allow passwordless power But all of this hinges upon a sudo system that works. If your sudoers file is broken then your AWS admin key is useless because you can login but you can't use sudo to elevate yourself. Total catch-22 problem. Getting admin access locked out on an AWS EC2 server is really nasty. Not all of us can run immutable infrastructure and not every server can be built from start to finish using automation. The server in this case was a massive beast with dozens of disk drives and LVM volumes in use. Nightmare to rebuild even with good backups and automation. The fix for this is operationally nasty and time consuming: - Shut down server - Detach root EBS volume - Start new server in same subnet - Mount the broken root disk onto the other server - Manually fix the things that are broken - Detach EBS disk and move back to original server - Start original server and hope you fixed all the broken things This can take 60 min or more if your automation is not prepared for things like this. This is where FreeIPA with RBAC rules saved the day. I was able to SSH into the server using my corporate AD username and password And thanks to a good RBAC rule that lets me run sudo on all AWS hosts I was able to "sudo su" and enter my AD password to gain root . The OS interaction between PAM and IPA does not depend on /etc/sudoers being syntactically correct! ... and this was the pivot I needed to fix the broken /etc/sudoers file and allow regular admin ops to occur Just wanted to shout out IPA for this. It totally took a 60min production issue and turned it into a 2 minute issue -Chris

1 0

NTP
by Andrew Meyer 04 Apr '18

04 Apr '18

I need some clarification on this. I have my FreeIPA server in talking. NTP is working. However Some servers are getting ntp drift. If I go into /etc/ntp.conf I see that at the bottom FreeIPA adds server at the bottom of the file. ### Added by IPA Installer ###server 127.127.1.0 iburstfudge 127.127.1.0 stratum 10server 1.2.3.4 # added by /sbin/dhclient-scriptserver 5.6.7.8 # added by /sbin/dhclient-scriptserver 9.0.1.2 # added by /sbin/dhclient-scriptserver 3.4.5.6 # added by /sbin/dhclient-script[centos@freeipa03 ~]$ But under the public servers at the top should I leave the the centos public ntp servers? Should I add the FreeIPA servers?

2 5

FreeIPA Certs for Chromebooks CMC,SCEP and extensions
by David Harvey 03 Apr '18

03 Apr '18

Hi FreeIPA users, As briefly mentioned in "[Freeipa-users] FreeIPA PKI with OpenVPN", I'm looking into using FreeIPA and Dogtag to provide network certs for Chromebooks (from reading so far it looks like I'll need to use SCEP or CMC - the latter being preferred). Has anyone achieved this, or can anyone offer any pointers to either the server or client/extension side hurdles? Kind regards, David

2 2

ca/agent/ca/displayBySerial': (SSL_ERROR_BAD_CERT_ALERT) SSL peer cannot verify your certificate.
by amitj1jan＠gmail.com 03 Apr '18

03 Apr '18

I came to the team new and don’t know the background, as to what all had been done, and recently we started getting one issue in DR environment: Using IPA 3.0.0 in both PROD/DR While trying to delete a host using IPA-UI or CLI, it is giving SSL error in DR(working in Prod): cannot connect to 'https://hostname:443/ca/agent/ca/displayBySerial': (SSL_ERROR_BAD_CERT_ALERT) SSL peer cannot verify your certificate. I set the debug mode and on making request: (ipa ping), I can see below error: ipa: INFO: Connection to https:hostnmae/ipa/xml failed with (SSL_ERROR_RX_RECORD_TOO_LONG) SSL received a record that exceeded the maximum permissible length. ipa: ERROR: cannot connect to Gettext('any of the configured servers', domain='ipa', localedir=None): https://hostname, https:hostname1/ipa/xml On troubleshooting, came across this(https://www.freeipa.org/page/Troubleshooting#Authentication_Errors): Ran below on DR: Use getcert list -d /etc/httpd/alias -n ipaCert Request ID '20170303094036': status: MONITORING stuck: no ------------------------------------ OK, till here, it means certificate nick-named ipaCert is being managed by Certmonger If it isn't in MONITORING, or it is and things still aren't working, compare the serial number of the certificate with that on other IPA masters: # certutil -L -d /etc/httpd/alias -n ipaCert | grep Serial certutil: Could not find cert: ipaCert : PR_FILE_NOT_FOUND_ERROR: File not found So, something is wrong here. In PROD, it works fine: [root@ProdHostName ~]# certutil -L -d /etc/httpd/alias -n ipaCert | grep Serial Serial Number: 7 (0x7) Further, investing the issue on DR: On DR: [root@DRHostName ipacerts]# certutil -L -d /etc/httpd/alias Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI Internal_Issuing_CA CT,C,C Internal_Root_CA CT,C,C DRHostName u,u,u On PROD: [root@ProdHostName ~]# certutil -L -d /etc/httpd/alias Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI FQDN IPA CA CT,C,C ipaCert u,u,u Signing-Cert u,u,u Server-Cert u,u,u I am not sure, but certificate - ‘ipaCert’ not being shown on using ‘certutil’ command seems to be an issue, need guidelines to understand, whether my investigation is on current line and if yes, how to resolve this. Will be happy to provide the output of any command or log-file. Thanks, Amit.

2 3

HOTP issues
by Spencer Shimko 02 Apr '18

02 Apr '18

Hi all, I'm having problems with HOTP with hardware tokens. They are Yubkey Neos, but physical access to the server is not a viable solution. I've configured keys and converted the hex to base 32. I've also generated HOTP via FreeIPA from the GUI and the CLI and converted those to hex and wrote those to the key. Both approaches have been tested and the generated OTPs appear to be valid. The issue is that when HOTP is enabled OTP does not appear to work. I've tested via kinit with an armored request and no pre-auth prompt for the OTP is presented. However, when tested with TOTP a prompt does appear and works appropriately. Perusing the list and web led me to a bug that was specific to expired passwords, which is not what I'm dealing with (AFAIK). I'm wondering if anyone else is seeing this issue - HOTP not working when TOTP does work. Thanks, --Spencer

1 0

Re: FreeIPA Assistance
by Vaibhav Jain 02 Apr '18

02 Apr '18

Thanks Michal, ++ Adding Team freeipa-users(a)lists.fedorahosted.org Team Need help on the above concern. On 28 March 2018 at 12:29, Michal Reznik <mreznik(a)redhat.com> wrote: > Hello, > > Thanks for your interest in FreeIPA. I would like to point you to " > freeipa-users(a)lists.fedorahosted.org" mailing list with regards of your > question as my knowledge of AD domain is quite limited and so that also > others can benefit from the info in the thread. > > Cheers... > > > On Tue, Mar 27, 2018 at 8:08 PM, Vaibhav Jain <vaibhavjain882(a)gmail.com> > wrote: > >> Hey Michal, >> >> Hope you are doing good. I am working with FreeIPA these days and I find >> this software amazing. Currently I am struggling with one problem, How to >> sync all the Windows AD users with password in FreeIPA deployed on a Centos >> box in replication mode. I tried searching for this over internet but >> didn't find any feasible solution for this. If you have any idea on this or >> any document on this please share. That will be a great help for me. If you >> know someone who can help me out with this please forward this mail to >> him/her or add him in this mail chain. >> >> Happy to have your contact. :D >> >> >> Thanks, >> Vaibhav Jain >> +91-8930011448 <+91%2089300%2011448> >> > > > > -- > > > Michal Reznik > > FreeIPA QE, > > Red Hat Brno <https://www.redhat.com> > > mreznik(a)redhat.com > <https://red.ht/sig> > >

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2018