July 2018 - FreeIPA-users - Fedora mailing-lists

freeIPa replica setup
by Alfredo De Luca 22 Jul '18

22 Jul '18

Hi all. I need to setup a freeIPA replica and not sure which is the best and more reliable. I found a few people preparing the replica from the server others just installing the replica on another machine with the appropriate configuration. Any info/docs? -- *Alfredo*

2 2

Re: FreeIPA-users Digest, Vol 15, Issue 18
by Николай Савельев 21 Jul '18

21 Jul '18

1 0

Running FreeIPA server containers on Ubuntu docker setups / Travis CI
by Jan Pazdziora 20 Jul '18

20 Jul '18

Hello, I and Stanislav have been setting up Travis CI for the https://github.com/freeipa/freeipa-container repository. We now run docker build operations for pull requests and commits, and I've been trying to add docker run tests as well. Example Travis build https://travis-ci.org/adelton/freeipa-container/builds/400275700 from https://github.com/adelton/freeipa-container/commit/16ced918f8492e583ff024b… seems to pass on CentOS and rawhide images but fails on other Fedoras. All the failures are in the Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes [1/28]: configuring certificate server instance [error] RuntimeError: CA configuration failed. step. I remember that due to the way systemd was handling KEYRING operations, seccomp:unconfined was one of the things that has been causing issues in our tests on Fedora hosts. Running docker info in Travis CI shows that it's running 17.09.0-ce and there are no Security Options listed, unlike on my Fedora 28's docker-1.13.1-59.gitaf6b32b.fc28.x86_64 which has Security Options: seccomp Profile: /etc/docker/seccomp.json selinux Are there people around with Ubuntu knowledge who could check what the docker 17.09.0-ce behaviour on that system is and if seccomp can somehow be tweaked? Thank you, -- Jan Pazdziora Senior Principal Software Engineer, Security Engineering, Red Hat

2 4

Integration of samba into a freeipa trust with AD
by Pierre Labanowski 20 Jul '18

20 Jul '18

Hi, everybody, I have a question about the best pratice use of freeipa with trust AD and/or sync relationship from winsync users. 1/ trust to set up an smb file sharing service via samba, would you advise to integrate it in the IPA realm or in the AD domain? Both are possible, but why one more than the other? in terms of file access performance (metadata, acl ,etc....) managed via the smb protocol isn't there a drawback related to samba in royaume ipa to serve users who use a windows client? 2/ winsync do you have the same response arguments in the case of a sync between AD and IPA? Thx Pierre

2 3

Getting Synology NAS to play nice with FreeIPA
by Kristian Petersen 20 Jul '18

20 Jul '18

I have a synology NAS which hosts some SMB shares on my network. I would like to be able to use FreeIPA as the LDAP provider it checks against for authenticating these shares. I have a system user that I created in FreeIPA for this purpose. I configured the NAS to connect to my FreeIPA server for LDAP, but I get a message about a failure to access some users NT passwords and how the Samba service may not work for these users. It also says it could be either a lack of NT passwords for the users or insufficient privileges to access them. After chatting with Synology support they wanted me to enable CIFS plaintext password authentication. However, if I select that option it given me a warning about the share not being able to be the remote mount target of CIFS anymore due to SMB being set to v1 only and disabling the SMB related Bonjour service. If the system user doesn't have the needed privileges, how can I fix that since I can't enroll the NAS? -- Kristian Petersen System Administrator BYU Dept. of Chemistry and Biochemistry

2 1

AD and IPA integration
by Николай Савельев 20 Jul '18

20 Jul '18

I changed password AD users. I can't login on ipa servers with new password, but can - with old. Why? I tried restart ipa services and reinitializing trust. but it didn't help. -- С уважением, Николай.

2 1

error 15 in memberof.so
by Bret Wortman 19 Jul '18

19 Jul '18

I've got a system (probably more than one) where I've got clients who aren't able to bring up SSSD due to this error, as seen in "journalctl -xe". I've tried unenrolling & re-enrolling. I've tried unenrolling, uninstalling, reinstalling ipa-client, and re-enrolling. I've tried unenrolling, deleting the host records from the IPA server, then re-enrolling. I've tried reinstalling SSSD. None have changed the behavior at all. Does anyone know what this error refers to or is caused by? -- photo *Bret Wortman* Founder, Damascus Products, LLC 855-644-2783 <tel:855-644-2783> | bret(a)wrapbuddies.co <mailto:bret@wrapbuddies.co> http://wrapbuddies.co/ 10332 Main St Suite 319 Fairfax, VA 22030 <http://facebook.com/wrapbuddiesco> <http://www.linkedin.com/in/bretwortman> <http://twitter.com/wrapbuddiesco> <http://instagram.com/wrapbuddies>

3 4

FreeIPA AD locked account vs public key authentication
by Bart 19 Jul '18

19 Jul '18

Hi all, I would like to use public key authentication in my FreeIPA setup for the users coming from the AD domain. I have everything set up correctly, public key authentication works great aside from one edge case that may render this setup unacceptable. When I lock an AD account (I test this by logging in with the wrong password more than allowed amount of times) user in question still can access FreeIPA managed hosts via public key authentication. According to the information I found regarding this behaviour - https://bugzilla.redhat.com/show_bug.cgi?id=973451 - this is a desired behaviour (it's not a bug, it's a feature). Still, it's not the configuration I am happy about :). Has anything changed since this bug was closed? Is there a way FreeIPA supports preventing users who are for whatever reason locked in AD from accessing FreeIPA-managed hosts? If this is not currently supported by default, maybe someone could point me to a way I could implement this myself? I am thinking of checking if the user is locked in AD, hopefully by looking at his/hers ldap attributes in the 389 ds server in FreeIPA if such attributes exist, then removing any public keys that are present in the Default Trust View for this user. At this point I do not know it is possible, it is just an idea. I would really appreciate your help.

2 1

Rename HBAC Rule
by Ronald Wimmer 19 Jul '18

19 Jul '18

Is there a way to rename an existing HBAC rule? The WebGUI only offers enable/disable/delete... Regards, Ronald

2 1

after promoting a clone as new renewal master, pki-tomcatd crashes with "Could not connect to LDAP", "Authentication failed (48)"
by Karl Forner 18 Jul '18

18 Jul '18

In the final step of upgrading my freeIPA servers to fedora26/freeIPA 4.4.4, I removed the current demoted the current renewal master, and promoted a CA (sif) as new renewal master, following instructions from < https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master#Rec… >. Since then, pki-tomcatd will not start, here's an excerpt of /var/log/pki/pki-tomcat/ca/debug : ``` [17/Jul/2018:15:34:57][localhost-startStop-1]: CMSEngine: ready to init id=dbs [17/Jul/2018:15:34:57][localhost-startStop-1]: DBSubsystem: init() mEnableSerialMgmt=true [17/Jul/2018:15:34:57][localhost-startStop-1]: Creating LdapBoundConnFactor(DBSubsystem) [17/Jul/2018:15:34:57][localhost-startStop-1]: LdapBoundConnFactory: init [17/Jul/2018:15:34:57][localhost-startStop-1]: LdapBoundConnFactory:doCloning true [17/Jul/2018:15:34:57][localhost-startStop-1]: LdapAuthInfo: init() [17/Jul/2018:15:34:57][localhost-startStop-1]: LdapAuthInfo: init begins [17/Jul/2018:15:34:57][localhost-startStop-1]: LdapAuthInfo: init ends [17/Jul/2018:15:34:57][localhost-startStop-1]: init: before makeConnection errorIfDown is true [17/Jul/2018:15:34:57][localhost-startStop-1]: makeConnection: errorIfDown true [17/Jul/2018:15:34:57][localhost-startStop-1]: TCP Keep-Alive: true [17/Jul/2018:15:34:57][localhost-startStop-1]: SSLClientCertificateSelectionCB: Setting desired cert nickname to: subsystemCert cert-pki-ca [17/Jul/2018:15:34:57][localhost-startStop-1]: LdapJssSSLSocket: set client auth cert nickname subsystemCert cert-pki-ca [17/Jul/2018:15:34:57][localhost-startStop-1]: SSLClientCertificatSelectionCB: Entering! [17/Jul/2018:15:34:57][localhost-startStop-1]: SSLClientCertificateSelectionCB: returning: null [17/Jul/2018:15:34:57][localhost-startStop-1]: SSL handshake happened Could not connect to LDAP server host sif.quartzbio.com port 636 Error netscape.ldap.LDAPException: Authentication failed (48) ``` I found this very useful blog: < https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomca… > and checked all the steps. From what I checked: - my certificates are valid - there was two userCertificate for pkidbuser, one expired. I removed it using Apache Directory Studio - the pkidbuser certificate match the one from /etc/pki/pki-tomcat/alias One possibly relevant info: the previous renewal master/CA was the main DNS, it is no longer running since I was about to recreate it when I discovered that the pki-tomcatd was not running when I tried to execute ipa-prepare-replicate. I would be grateful if you could help me or guide me debugging this. Thanks, Karl. Additional info: ipa config-show ----------------------- Maximum username length: 32 Home directory base: /home Default shell: /bin/bash Default users group: ipausers Default e-mail domain: example.com Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: FALSE Certificate Subject base: O=QUARTZBIO.COM Password Expiration Notification (days): 4 Password plugin features: AllowNThash SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: nfs:NONE, MS-PAC IPA masters: amora.example.com, sif.example.com IPA CA servers: amora.example.com, sif.example.com IPA NTP servers: amora.example.com, sif.example.com IPA CA renewal master: sif.example.com grep internaldb.ldap /etc/pki/pki-tomcat/ca/CS.cfg ------------------------------ internaldb.ldapauth.authtype=SslClientAuth internaldb.ldapauth.bindDN=cn=Directory Manager internaldb.ldapauth.bindPWPrompt=internaldb internaldb.ldapauth.clientCertNickname=subsystemCert cert-pki-ca internaldb.ldapconn.cloneReplicationPort=389 internaldb.ldapconn.host=sif.example.com internaldb.ldapconn.masterReplicationPort=389 internaldb.ldapconn.port=636 internaldb.ldapconn.replicationSecurity=TLS internaldb.ldapconn.secureConn=true sudo certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' ------------------------------------ Data: Version: 3 (0x2) Serial Number: 86 (0x56) Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption Issuer: "CN=Certificate Authority,O=QUARTZBIO.COM" Validity: Not Before: Wed May 31 15:49:31 2017 Not After : Tue May 21 15:49:31 2019 Subject: "CN=CA Subsystem,O=QUARTZBIO.COM" ... sudo grep internal /var/lib/pki/pki-tomcat/conf/password.conf | cut -d= -f2 > /tmp/pwdfile.txt sudo certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'subsystemCert cert-pki-ca' ----------------------------------------------------------- certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" < 0> rsa 4c9dcd686df2a289ef1bcd21d2dfb195a0d7bc9c subsystemCert cert-pki-ca sudo cat /etc/dirsrv/slapd-IPADOMAIN-COM/certmap.conf ---------------------- default:DNComps default:FilterComps uid certmap ipaca CN=Certificate Authority,O=QUARTZBIO.COM ipaca:CmapLdapAttr seeAlso ipaca:verifycert on ldapsearch -LLL -D 'cn=directory manager' -W -b uid=pkidbuser,ou=people,o=ipaca description ----------------------------- dn: uid=pkidbuser,ou=people,o=ipaca description: 2;86;CN=Certificate Authority,O=QUARTZBIO.COM;CN=CA Subsystem,O=Q UARTZBIO.COM sudo certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | grep Serial ------------------------ Serial Number: 86 (0x56) getcert list | grep "expires\|status\|subject" | perl -pe 's/quartzbio/example/ig' status: MONITORING subject: CN=sif.example.com,O=example.COM expires: 2020-07-13 13:44:48 CEST status: MONITORING subject: CN=CA Audit,O=example.COM expires: 2019-05-21 17:50:42 CEST status: MONITORING subject: CN=OCSP Subsystem,O=example.COM expires: 2019-05-21 17:50:01 CEST status: MONITORING subject: CN=CA Subsystem,O=example.COM expires: 2019-05-21 17:49:31 CEST status: MONITORING subject: CN=Certificate Authority,O=example.COM expires: 2035-07-09 11:41:54 CEST status: MONITORING subject: CN=sif.example.com,O=example.COM expires: 2020-07-02 16:57:18 CEST status: MONITORING subject: CN=sif.example.com,O=example.COM expires: 2020-07-13 13:44:52 CEST status: MONITORING subject: CN=IPA RA,O=example.COM expires: 2019-05-21 17:50:10 CEST

3 5

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2018