February 2019 - FreeIPA-users - Fedora mailing-lists

Freeipa and squid
by Николай Савельев 14 Feb '19

14 Feb '19

Hello. There is perfect article about squid and freeipa - https://www.freeipa.org/page/Squid_Integration_with_FreeIPA_using_Single_Si… But I want to access in Internet with different rules - some group with full access, some - without sotial networks, an group without access, I use helper ext_kerberos_ldap_group_acl an all works fine. But with AD users it dont work. IPA domain - FS.LAN AD domain - START-LINE.LOCAL kerberos_ldap_group: ERROR: Error while getting tgt : Server krbtgt/START-LINE.LOCAL(a)FS.LAN I tried to do debug: kerberos_ldap_group: DEBUG: Get principal name from keytab /etc/krb5.keytab kerberos_ldap_group: DEBUG: Keytab entry has realm name: FS.LAN kerberos_ldap_group: DEBUG: Did not find a principal in keytab for domain START-LINE.LOCAL. kerberos_ldap_group: DEBUG: Try to get principal of trusted domain. kerberos_ldap_group: DEBUG: Keytab entry has principal: host/mail.fs.lan(a)FS.LAN kerberos_ldap_group: ERROR: Error while getting TGT : Server krbtgt/START-LINE.LOCAL(a)FS.LAN not found in Kerberos database May I could doing somthing trought manipulation with sssd.conf or krb5.conf? -- С уважением, Николай.

1 0

CA no certs being tracked?
by Chris Mohler 14 Feb '19

14 Feb '19

Hi Everyone, I'm looking for some help. I'm having trouble with everything basically. I think one of my CA's certs expired or something. I can't kinit admin, I can't login via the WebGui. If I "getcert list" it returns "Number of certificates and requests being tracked: 0." This all started happening a few days ago and I am at a loss as to what happened. On a whim I set the system date and time back a few months to see if my certs were expired and like magic I can login to the Webgui but I'm still not tracking anything with "getcert list" I suspect the cert has expired but without tracking it I can't tell, or renew it. Please help I'm running Centos 7, FreeIPA 4.5.4 Thanks, -Chris

3 18

Map local user to kerberos
by Николай Савельев 13 Feb '19

13 Feb '19

Hi. I want to config some app (1c enterprise) for authentication via freeipa. This app uses mapping local user usr1cv8 to kerberos user, usr1cv8(a)KERBEROS.DOMAIN All manuals - about mapping with Active Directory user. Russian - https://its.1c.ru/db/metod8dev#content:2799:hdoc English - https://1c-dn.com/library/Kerberos_authentification_setup_example_for_Linux… What have to I change for freeipa? Can I create service usr1cv8/host(a)IPA.DOMAIN? Or how can I map local user to ipa user? -- С уважением, Николай.

2 2

Looking Again
by Mitchell Smith 12 Feb '19

12 Feb '19

Hi Melissa, I just wanted to drop you an email to let you know I am actively looking again. I have been with my current employer for approaching four months now, and unfortunately I am not really enjoying it. As you will have noticed from my resume, I tend to stick with employers for several years, and I can’t envision that happening with my current role. If you have any opportunities available in Sydney at the moment that you think would be a good match, then I would be very interested to discuss them with you. I have attached another copy of my resume to this email for your convenience. Thanks for your time. Mitch

1 0

Unable to connect to Kerberized NFS after reboot
by Darac Marjal 12 Feb '19

12 Feb '19

Hello all, I have a server running Proxmox, on which I have a virtual machine running FreeIPA. I did have this set up running Kerberized NFS, but a while ago, I rebooted the Proxmox host and now I always get "Permission Denied" when trying to mount the NFS server. To give more detail, the Proxmox server (Debian Based) is running proxmox 5.3-8 (latest version) and is joined to the FreeIPA domain: # realm list ghibli.darac.org.uk type: kerberos realm-name: GHIBLI.DARAC.ORG.UK domain-name: ghibli.darac.org.uk configured: kerberos-member server-software: ipa client-software: sssd required-package: freeipa-client required-package: sssd-tools required-package: sssd required-package: libnss-sss required-package: libpam-sss login-formats: %U(a)ghibli.darac.org.uk login-policy: allow-realm-logins The NFS server is configured as follows: # for i in /etc/default/nfs-* /etc/exports; do echo "---- $i"; grep "^[^#]" $i; done ---- /etc/default/nfs-common NEED_STATD= STATDOPTS= NEED_IDMAPD=yes NEED_GSSD=yes ---- /etc/default/nfs-kernel-server RPCNFSDCOUNT=8 RPCNFSDPRIORITY=0 RPCMOUNTDOPTS="--manage-gids -N 2 -N 3 -d all" NEED_SVCGSSD="yes" RPCSVCGSSDOPTS=" -v -v -v" RPCNFSDOPTS=" -d 3" ---- /etc/exports /tank 192.0.0.0/24(rw,sec=sys:krb5:krb5i:krb5p,no_subtree_check,no_root_squash) The server has keys, too (I have tried refreshing these with `ipa-getkeytab -r -s ipaserver -p nfs/gusteau.darac.org.uk -k /etc/krb5.keytab`) # klist -ke /etc/krb5.keytab Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 9 host/gusteau.darac.org.uk(a)GHIBLI.DARAC.ORG.UK (aes256-cts-hmac-sha1-96) 9 host/gusteau.darac.org.uk(a)GHIBLI.DARAC.ORG.UK (aes128-cts-hmac-sha1-96) 9 nfs/gusteau.darac.org.uk(a)GHIBLI.DARAC.ORG.UK (aes256-cts-hmac-sha1-96) 9 nfs/gusteau.darac.org.uk(a)GHIBLI.DARAC.ORG.UK (aes128-cts-hmac-sha1-96) The client is, for example, my laptop running Debian. It, too, is joined to the domain: # realm list ghibli.darac.org.uk type: kerberos realm-name: GHIBLI.DARAC.ORG.UK domain-name: ghibli.darac.org.uk configured: kerberos-member server-software: ipa client-software: sssd required-package: freeipa-client required-package: sssd-tools required-package: sssd required-package: libnss-sss required-package: libpam-sss login-formats: %U(a)ghibli.darac.org.uk login-policy: allow-realm-logins It, too, has these keys: # klist -ke /etc/krb5.keytab Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 4 host/toothless.darac.org.uk(a)GHIBLI.DARAC.ORG.UK (aes256-cts-hmac-sha1-96) 4 host/toothless.darac.org.uk(a)GHIBLI.DARAC.ORG.UK (aes128-cts-hmac-sha1-96) 2 nfs/toothless.darac.org.uk(a)GHIBLI.DARAC.ORG.UK (aes256-cts-hmac-sha1-96) 2 nfs/toothless.darac.org.uk(a)GHIBLI.DARAC.ORG.UK (aes128-cts-hmac-sha1-96) And the user has a valid ticket: # klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: darac(a)GHIBLI.DARAC.ORG.UK Valid starting Expires Service principal 03/02/19 19:31:44 04/02/19 19:31:38 krbtgt/GHIBLI.DARAC.ORG.UK(a)GHIBLI.DARAC.ORG.UK However, when I try to mount the server: # mount -v -t nfs4 -o sec=krb5 gusteau.darac.org.uk:/tank mnt mount.nfs4: timeout set for Sun Feb 3 19:34:49 2019 mount.nfs4: trying text-based options 'sec=krb5,vers=4.2,addr=192.0.2.100,clientaddr=192.0.2.187' mount.nfs4: mount(2): Permission denied mount.nfs4: access denied by server while mounting gusteau.darac.org.uk:/tank My problem is that I've run out of places to look for errors. I've tried enabling NFS debugging, but I don't see anything obvious there. I've also looking in /var/log/krb5kdc.log on the FreeIPA server, but I don't see any log messages there when the mount is attempted. Apologies if this isn't the right place to ask about this, but it's one of these questions of "Is it FreeIPA at fault? Is it Kerberos? Is it my setup?" and I've got to start somewhere. Many thanks.

1 2

FreeIPA-Client now in Debian Buster
by Jochen Hein 11 Feb '19

11 Feb '19

Hello, today freeipa-client migrated from sid to buster - thanks a lot for this! Jochen -- This space is intentionally left blank.

1 0

FreeIPA FreeRADIUS and WiFi (EAP-TLS) not working
by Nick Dawson 11 Feb '19

11 Feb '19

Hey folks, I've been banging my head against trying to get FreeRADIUS to work with FreeIPA for WiFi Auth. The good news is that I've learned a ton, the bad news is that I'm quite lost still :) My main goal is a secure way to do user-based (user/pass) auth on a WiFi network. I've been trying to wrap my head around the differences between EAP-TLS and EAP-TTLS and how different inner and outer tunnels interact with FreeIPA. I've followed literally every guide, mailing list post, and blog that comes up in the top 20 google results. There's a surprising few, and all seem to share the same genesis. That makes me wonder, is this stuff easy and obvious to most? Or is it rarely done and not really supported? First question: I think I understand that the most commonly used option is EAP-TLS and PEAP with mschapv2. And that required ntmhashes (I've done the AD trust steps). Is there a more secure way? Could I do EAP-TTLS with user certs and keep the passwords encrypted end to end to the ldap server? Is there a way that doesn't require the ntmhashes? Here's what I've done: 1. I've created a radius/host.... service account. 2. I've assigned It a password and can kinit against it 3. That principal and pass are in /mods-enabled/ldap as: identity = krbprincipalname=radius/ipa.secure.nsnet.us(a)SECURE.MYDOMAIN.US,cn=serv ices,cn=accounts,dc=secure,dc=mydomain,dc=us password = HDdkr%rkd094D!@ekd (Not my actual pass, but representative of the complexity and characters) And here's what I get: >rlm_ldap (ldap): Waiting for bind result... >rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials >rlm_ldap (ldap): Opening connection failed (0) >rlm_ldap (ldap): Removing connection pool >/etc/raddb/mods-enabled/ldap[8]: Instantiation failed for module "ldap" I've also tried creating a user account and assigning it access rights to the radius server role and I assigned it rights to read the ntmhashes. That works (binds and radtest works) and can bind, but EAP fails. Anyone have any tips on getting up and running with FreeRADIUS and WiFi?

2 1

need to rebuild replica agreement between 2 locations
by Kat 11 Feb '19

11 Feb '19

Hi all, Things have been going along smoothly and no issues with FreeIPA until recently. Consider the following: Original Config: ipa-1 <---> ipa-2 <-|-> ipa-3 <---> ipa-4 Stage | Prod Yes, this was not a perfect design because exactly what I feared happened. The connection between 2 and 3 got broken and ipa-2 actually failed an Upgrade and the only way to get it working again was to re-install ipa-server and make it a replica with ipa-1 The problem is - now I have 2 "separate" environments instead of a shared one because I cannot figure out a way to get ipa-3 to reconnect to ipa-2 as a replica agreement. This is all with latest RHEL 7.6 and 4.6.4-10.el7_6.2 version of IPA on all 4 nodes. Prior to the upgrade, everything was fine and replication was running across all 4 nodes. During the upgrade (patching) process ipa-2 got a database error and it was not detected for 2 days. When you tried to restart it - it wanted to upgrade the database, the same as all the other 3 but failed with errors and there seemed to be no way to get them to sync up. It has been 4 days now. I would love to get all 4 talking again, but because ipa-2 was rebuilt using ipa-1 as the master it connected to, it won't talk to ipa-3. I was trying several of the new "topology" commands to try to get them connected, but no luck. Any ideas on how I might accomplish getting the 2 environments re-connected? Thanks K

2 1

Add a picture to freeipa user
by Rufa Rufa 09 Feb '19

09 Feb '19

Hello, Can someone please help me to add a picture to the freeipa user, i did the following steps: 1- Create a new file with ldif extension: $vi test.ldif 2- copy the following lines: dn: cn=schema changetype: modify add: attributeTypes attributeTypes: ( 2.25.28639311321113238241701611583088740684.14.2.2 NAME 'UsersPicture' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Extending FreeIPA' ) dn: cn=schema changetype: modify add: objectclasses objectclasses: ( 2.25.28639311321113238241701611583088740684.14.2.1 (Not sure if it should be the same than attribute and change 2 by 1 at the end) NAME 'customPerson' SUP person STRUCTURAL MAY ( UsersPicture ) X-ORIGIN 'Extending FreeIPA' ) 3- Get kerberos ticket: $kinit admin 4- add the attribute and objectclass to the ldap with the following command (joined webpage About the IDM client tools): $ldapmodify -D "cn=Directory Manager" -W -p 389 -h ipaserver.example.com -f test.ldif -v 5- Restart freeipa server: $ipactl restart 6- ipa config-mod --addattr=ipaUserObjectClasses=object_class_name_added_above 7- Add the attribute to a user $ ipa user-mod ttest1 --addattr=UsersPicture=path_to_the_picture 8- Verify if the user has the new attribute: $ipa user-show --all loginname | grep UsersPicture $userspictures: L2hvbw....uanBn How to add this attribute to the GUI users to check if the picture is working ? Thanks,

2 1

AD Trust: Add "mail" user attribute to AD -> IPA transfer
by Lenhardt, Matthias 09 Feb '19

09 Feb '19

Hi, we have an IPA 4.6.4 environment with an AD Trust configured and everything's working perfectly. My question is: Is it possible to configure, that extra AD user attributes are transfered? I would need the AD user attribute "mail" with the users email address. This question came up, after I tried to connect GitLab to IPA and authentication with an AD users fails, because IPA doesn't have the "mail" attribute of the user, so logging is denied. (Authentication on Linux systems is working). Thanks in advance! Regards Matthias Lenhardt System Administrator BITMARCK ***************************************************************** Die Information in dieser E-Mail ist vertraulich und ausschließlich für den/die benannten Adressaten bestimmt. Ein Zugriff auf diese E-Mail durch andere Personen als den/die benannten Adressaten ist nicht gestattet. Sollten Sie nicht der benannte Adressat sein, löschen Sie bitte diese E-Mail.

3 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2019