January 2019 - FreeIPA-users - Fedora mailing-lists

Cert issue on master IPA server
by Mitchell Smith 08 Jan '19

08 Jan '19

Hi List, I am running in to an issue joining a new replica to our IPA environment. It’s worth noting that we have had issues with expired certs on our master server for a while but I thought we had resolved them, and when I connect to ports 443 and 636 on the master server I get certs back expiring in 2020. So I have run IPA-client-install and the client joins successfully. I can ‘kinit admin’ and kerberos auth appears to work. When I run ipa-replica-install it hangs on step 27 restarting directory server. When I check syslog I see that dirsrv has failed to restart, and the following message. Jan 8 02:20:11 ds02 certmonger[8516]: 2019-01-08 02:20:11 [8516] Server at https://ds01.prod.xyz.internal/ipa/xml failed request, will retry: 907 (RPC failed at server. cannot connect to 'https://ds01.prod.xyz.internal:443/ca/eeca/ca/profileSubmitSSLClient': (SSL_ERROR_EXPIRED_CERT_ALERT) SSL peer rejected your certificate as expired.). Where ds02 is the new replica I am installing and ds01 is the original master. Running FreeIPA 4.3.1. Any suggestions on how to move past this point would be greatly appreciated. Thanks in advance.

2 2

IPA Server SSL RC4 Cipher Suites on Port 443
by Christopher Lamb 08 Jan '19

08 Jan '19

2 3

Samba server on Ubuntu not working
by Kees Bakker 08 Jan '19

08 Jan '19

Hey, Is there any chance that the combination FreeIPA + Samba + Ubuntu is going to work in the near future? So far I haven't been able to. The main purpose is to give Windows users access to disk space on our (Ubuntu) servers. And with their IPA credentials. I know that Alexander knows a whole lot about Samba and FreeIPA. But not so much about the combination with Ubuntu, I think (except that Heimdal versus MIT Kerberos plays a role). Timo may know more about the Ubuntu part, but I don't think he has the whole setup with FreeIPA+Samba. In 2016 (yes, that long ago) Alexander wrote [1] "Let me comment as FreeIPA and Samba upstream developer. Ubuntu's Samba build is done with Heimdal and you cannot build ipasam.so against Heimdal, only MIT Kerberos. So you cannot use Ubuntu-provided Samba build this way even if you'd recompile FreeIPA with patches we have upstream to deal with libpdb -> libsamba-pdb library name change. So until Samba in Debian and Ubuntu is built against Heimdal Kerberos (this is due to Debian/Ubuntu packaging Samba AD, not just Samba) it is unlikely to have FreeIPA trust to AD working in Ubuntu. We are fairly close with completing port of Samba AD to MIT Kerberos upstream, this should happen in Samba 4.5-4.6 timeframe. Once that is done, we can expect FreeIPA with trust to AD working on Debian-based platforms as well." It's 2019 now. I've tried Ubuntu 18.04 (with Samba 4.7.6), but I still can't get it to work. Possibly because MIT KDC is not enabled in Ubuntu's samba [2]. The following test shows empty. # smbd -b | grep HAVE_LIBKADM5SRV_MIT Argh, what are my options? [1] https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1552249/comments/2 [2] https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC -- Kees Bakker

2 3

How to restrict access for users to specific hosts
by 74cmonty 07 Jan '19

07 Jan '19

Hi, how can I restrict access for users to specific hosts? Please advise. THX

3 3

How to restrict access by only users of a specific AD group
by Dmitrii M 04 Jan '19

04 Jan '19

Hi, I have a FreeIPA server as server.ipa.linux.dom, domain name is ipa.linux.dom with a configured one-way trust with Windows Server 2016 Active Directory domain as windows.dom. I can log in to linux clients by ssh using AD accounts like ssh aduser@window.dom@hostname. It works just fine thanks to the groups created with --external option. kinit <ipauser> and kinit <aduser(a)windows.dom> also work. Now my next phase is to configure some applications so AD users should be able to authenticate in those apps. And also I need to restrict such access by only users who are members of specific AD groups. I started doing this for Apache using its mod_ldap module. Below is a config that I am trying to get working. If I put "Require valid-user" option in the below config it confirms that I can authenticate in Apache using my AD account. Now I need to restrict access to Apache by only the users who are in the apacheusers(a)windows.dom AD group. This is a current Apache config which I cannot properly set up and I need your help in this. # https://httpd.apache.org/docs/2.4/mod/mod_authnz_ldap.html <Directory /var/www/html/auth-ldap> Order deny,allow Allow from All AuthName "LDAP Authentication" AuthType Basic AuthBasicProvider ldap AuthLDAPUrl ldap://server.ipa.linux.dom/dc=ipa,dc=linux,dc=dom?uid?sub AuthLDAPBindDN uid=apachebind,cn=users,cn=accounts,dc=ipa,dc=linux,dc=dom AuthLDAPBindPassword Admin123 AuthLDAPGroupAttributeIsDN off AuthLDAPGroupAttribute memberUid Require ldap-group cn=apacheusers_ad(a)windows.dom,cn=groups,cn=compat,dc=ipa,dc=linux,dc=dom </Directory> uid=apachebind is a user created in FreeIPA. cn=apacheusers_ad(a)windows.dom is a group name added to Default Trust View as an overridden AD group apacheusers(a)windows.dom. The above config is based on the info which I get if I run such ldapsearch command. It tells that I need to check apacheusers_ad(a)windows.dom group to define members of that group. $ ldapsearch -Y GSSAPI -b 'dc=ipa,dc=linux,dc=dom' "(&(objectClass=posixGroup)(cn=apacheusers_ad(a)windows.dom))" SASL/GSSAPI authentication started SASL username: admin(a)IPA.LINUX.DOM SASL SSF: 256 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <dc=ipa,dc=linux,dc=dom> with scope subtree # filter: (&(objectClass=posixGroup)(cn=apacheusers_ad(a)windows.dom)) # requesting: ALL # # apacheusers_ad(a)windows.dom, groups, compat, ipa.linux.dom dn: cn=apacheusers_ad(a)windows.dom,cn=groups,cn=compat,dc=ipa,dc=linux,dc=dom objectClass: posixGroup objectClass: ipaOverrideTarget objectClass: top gidNumber: 1000111 memberUid: hassudo(a)windows.dom memberUid: apacheuser(a)windows.dom memberUid: apachebind(a)windows.dom memberUid: user2(a)windows.dom memberUid: user1(a)windows.dom ipaAnchorUUID:: OlNJRDpTLTEtNS0yMS0xODk0OTg2MDMtMjU5NDAxODQ4OC0xNDAzMzI5NDE1LT ExMDk= cn: apacheusers_ad(a)windows.dom # search result search: 4 result: 0 Success # numResponses: 2 # numEntries: 1 I'm trying to log in to Apache as user1(a)windows.dom user $ id -a uid=1959401104(user1(a)windows.dom) gid=1959401104(user1(a)windows.dom) groups=1959401104(user1@windows.dom),1000111(apacheusers_ad@windows.dom),117000008(apacheusers),1959400513(domain users@windows.dom),1959401105(winusers@windows.dom) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 The group 117000008(apacheusers) is a IPA group, AD group added to this as an external member. But I don't understand how to verify in Apache whether user1 a member of it. So I tried two options: ID Views and IDM Group with an external member apacheusers(a)windows.dom but still didn't find how a ldap filter in Apache should look like. I suppose that I miss something but I don't understand what. Sorry for so long text but I am working on this problem for a few days already and still don't have a proper result. I just need to restrict access to Apache by the users who are members of AD group apacheusers(a)windows.dom. Here are software versions. FreeIPA server 7.6.1810 and a client are the same OS version but there are also some plans to connect Ubuntu 14.04 and 16.04 clients. Server packages versions: $ rpm -qa | grep -E '^(ipa|sss)' sssd-krb5-common-1.16.2-13.el7.x86_64 sssd-ldap-1.16.2-13.el7.x86_64 sssd-1.16.2-13.el7.x86_64 ipa-server-trust-ad-4.6.4-10.el7.centos.x86_64 ipa-common-4.6.4-10.el7.centos.noarch ipa-client-common-4.6.4-10.el7.centos.noarch sssd-client-1.16.2-13.el7.x86_64 sssd-common-1.16.2-13.el7.x86_64 sssd-common-pac-1.16.2-13.el7.x86_64 sssd-ad-1.16.2-13.el7.x86_64 sssd-krb5-1.16.2-13.el7.x86_64 sssd-proxy-1.16.2-13.el7.x86_64 ipa-server-dns-4.6.4-10.el7.centos.noarch sssd-ipa-1.16.2-13.el7.x86_64 sssd-dbus-1.16.2-13.el7.x86_64 ipa-client-4.6.4-10.el7.centos.x86_64 ipa-server-4.6.4-10.el7.centos.x86_64 ipa-server-common-4.6.4-10.el7.centos.noarch Active Directory is run on Windows 2016 server in default configuration. Also learnt threads in redhat & freeipa mail lists but didn't find a proper solution for me. I am thankful for any help, Dmitrii

1 0

Service named-pkcs11.service on replica reports error: Failed to get initial credentials (TGT) using principal 'DNS/ipa-replica.example.com' and keytab 'FILE:/etc/named.keytab' (Generic error (see e-text))
by 74cmonty 04 Jan '19

04 Jan '19

Hi, when I start service `named-pkcs11.service` on replica server I get these error messages: ``` Dez 29 17:33:28 ipa-replica.example.com named-pkcs11[3936]: Failed to get initial credentials (TGT) using principal 'DNS/ipa-replica.example.com' and keytab 'FILE:/etc/named.keytab' (Generic error (see e-text)) [...] Dez 29 17:34:04 ipa-replica.example.com ipa-dnskeysyncd[3942]: ipa-dnskeysyncd: CRITICAL Kerberos authentication failed: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529638972): Generic error (see e-text) Dez 29 17:34:04 ipa-replica.example.com systemd[1]: ipa-dnskeysyncd.service: Main process exited, code=exited, status=1/FAILURE ``` The service is starting successfully though. The full log is available here: http://freetexthost.com/e53jnsslf1 What's causing this error?

2 2

FreeIPA not working (Segfault in Kerberos) after upgrading to Fedora 29
by Patrick Dung 03 Jan '19

03 Jan '19

Hello, After upgrading to Fedora 29, Kerberos on the primary Free IPA is not working. Another FreeIPA replica failed to start. It is because Kerberos (GSSAPI) is not working and ns-slapd cannot start. Replication agreement cannot be established via Kerberos (GSSAPI) I got this messages in for the kernel log. Dec 27 02:00:05 server1 kernel: [ 2551.272984] krb5_child[25058]: segfault at 6e ip 00007f58ae29464e sp 00007fffb5047bf0 error 4 in libkrb5.so.3.3[7f58ae26b000+71000] Dec 27 02:00:05 server1 kernel: [ 2551.273449] Code: fc bf 28 00 00 00 55 53 48 83 ec 18 64 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 e8 2b 9b fd ff 48 85 c0 0f 84 02 01 00 00 <f3> 41 0f 6f 07 f3 41 0f 6f 4f 10 48 89 c3 49 63 7f 20 0f 11 00 0f Dec 27 02:00:05 server1 kernel: [ 2551.272984] krb5_child[25058]: segfault at 6e ip 00007f58ae29464e sp 00007fffb5047bf0 error 4 in libkrb5.so.3.3[7f58ae26b000+71000] Dec 27 02:00:05 server1 kernel: [ 2551.273449] Code: fc bf 28 00 00 00 55 53 48 83 ec 18 64 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 e8 2b 9b fd ff 48 85 c0 0f 84 02 01 00 00 <f3> 41 0f 6f 07 f3 41 0f 6f 4f 10 48 89 c3 49 63 7f 20 0f 11 00 0f Any ideas? FYI I had already opened a ticket in bugzilla: 1662175 – Segfault in freeipa/krb5_child after upgrading to Fedora 29 | | | | 1662175 – Segfault in freeipa/krb5_child after upgrading to Fedora 29 | | | Thanks,Patrick

3 2

yum upgrade doesn't do IPA upgrade
by Charles Hedrick 03 Jan '19

03 Jan '19

For some reason on one of our 3 servers, yum update didn’t run the IPA upgrade. /var/log/ipaupgrade.log was zero length. “ipactl start” noted that an upgraded was needed, and did it. So it wasn’t a big deal. But it would be nice for yum update to show some sign if there’s an issue. And perhaps output a message saying that the upgrade was done successfully.

2 1

Adding Linux client in WebUI reports error: The host was added but the DNS update failed with: DNS reverse zone 168.192.in-addr.arpa. for IP address 192.168.1.47 is not managed by this server
by 74cmonty 02 Jan '19

02 Jan '19

Hi, I have completed setup of FreeIPA on 2 nodes: master + replica Both servers are configured in network 192.168.100.0/24. For both nodes I have defined a DNS forwarder to 192.168.1.101; this is my main DNS server running Pi-hole (Linux network-level advertisement and internet tracker blocking application). Now I try to add a Linux client with this IP 192.168.1.47 in the WebUI and I get this error message: The host was added but the DNS update failed with: DNS reverse zone 168.192.in-addr.arpa. for IP address 192.168.1.47 is not managed by this server How can I solve this issue w/o shutting down Pi-hole? Is the concept of using Pi-hole as a DNS forwarder suboptimal? Please advise. THX

3 4

Service named-pkcs11.service on master fails: Process 3946 (named-pkcs11) of user 25 dumped core
by 74cmonty 02 Jan '19

02 Jan '19

Hi, starting service `named-pkcs11.service` fails with a core dump: ``` Dez 29 17:32:25 ipa-master.example.com systemd-coredump[2901]: Process 2895 (named-pkcs11) of user 25 dumped core. Stack trace of thread 2897: #0 0x00007f2b386c753f raise (libc.so.6) #1 0x00007f2b386b1895 abort (libc.so.6) #2 0x00007f2b386b1769 __assert_fail_base.cold.0 (libc.so.6) #3 0x00007f2b386bf9f6 __assert_fail (libc.so.6) #4 0x00007f2b38fb8c95 n/a (libkrb5.so.3) #5 0x00007f2b38fb96ef n/a (libkrb5.so.3) #6 0x00007f2b38fc2d0c n/a (libkrb5.so.3) #7 0x00007f2b38fbc8b3 n/a (libkrb5.so.3) #8 0x00007f2b38fbb9dd krb5_cc_select (libkrb5.so.3) #9 0x00007f2b3909b959 n/a (libgssapi_krb5.so.2) #10 0x00007f2b390a4a82 n/a (libgssapi_krb5.so.2) #11 0x00007f2b390a5b06 n/a (libgssapi_krb5.so.2) #12 0x00007f2b3908f0bb gss_init_sec_context (libgssapi_krb5.so.2) #13 0x00007f2b34824667 gssapi_client_mech_step (libgssapiv2.so) #14 0x00007f2b34907471 sasl_client_step (libsasl2.so.3) #15 0x00007f2b349075fa sasl_client_start (libsasl2.so.3) #16 0x00007f2b3494624b ldap_int_sasl_bind (libldap-2.4.so.2) #17 0x00007f2b349498ec ldap_sasl_interactive_bind (libldap-2.4.so.2) #18 0x00007f2b34949b0a ldap_sasl_interactive_bind_s (libldap-2.4.so.2) #19 0x00007f2b34992c6f ldap_connect (ldap.so) #20 0x00007f2b3499fa90 new_ldap_instance (ldap.so) #21 0x00007f2b34990292 dyndb_init (ldap.so) #22 0x00007f2b3943f75a dns_dyndb_load (libdns-pkcs11.so.1102) #23 0x00005612e6a46718 n/a (named-pkcs11) #24 0x00005612e6a53ed3 n/a (named-pkcs11) #25 0x00005612e6a54f47 n/a (named-pkcs11) #26 0x00007f2b3938d899 n/a (libisc-pkcs11.so.169) #27 0x00007f2b38bd458e start_thread (libpthread.so.0) #28 0x00007f2b3878c6a3 __clone (libc.so.6) Stack trace of thread 2898: #0 0x00007f2b38bdaa8a pthread_cond_timedwait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f2b393ad2b0 isc_condition_waituntil (libisc-pkcs11.so.169) #2 0x00007f2b39394683 n/a (libisc-pkcs11.so.169) #3 0x00007f2b38bd458e start_thread (libpthread.so.0) #4 0x00007f2b3878c6a3 __clone (libc.so.6) Stack trace of thread 2899: #0 0x00007f2b3878c9d7 epoll_wait (libc.so.6) #1 0x00007f2b393a501c n/a (libisc-pkcs11.so.169) #2 0x00007f2b38bd458e start_thread (libpthread.so.0) #3 0x00007f2b3878c6a3 __clone (libc.so.6) Stack trace of thread 2896: #0 0x00007f2b38bda73c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f2b3938d695 n/a (libisc-pkcs11.so.169) #2 0x00007f2b38bd458e start_thread (libpthread.so.0) #3 0x00007f2b3878c6a3 __clone (libc.so.6) Stack trace of thread 2895: #0 0x00007f2b386c78ee __sigsuspend (libc.so.6) #1 0x00007f2b3939713e isc__app_ctxrun (libisc-pkcs11.so.169) #2 0x00007f2b39397d73 isc_app_run (libisc-pkcs11.so.169) #3 0x00005612e6a07d05 n/a (named-pkcs11) #4 0x00007f2b386b3413 __libc_start_main (libc.so.6) #5 0x00005612e6a0865e n/a (named-pkcs11) Dez 29 17:32:25 ipa-master.example.com audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-coredump@10-2900-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' ``` Full log is available here: http://freetexthost.com/nx1e4xhmyi Assuming this issue is related to file /usr/lib64/bind/ldap.so I tried to scp from replica server. However this fails with this weird error: ```[root@ipa-master ~]# ssh -p 22202 ipa-replica.example.com ssh_exchange_identification: Connection closed by remote host [root@ipa-master ~]# scp -P 22201 ipa-replica.example.com:/usr/lib64/bind/ldap.so /home/ Password: \033[0m\033[1;34m /:-------------:\ \033[0m\033[1;34m root\033[0m\033[1m(a)\033[0m\033[0m\033[1;34mipa-replica.example.com\033[0m ````

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2019