March 2020 - FreeIPA-users - Fedora mailing-lists

Managing different Sub CAs in FreeIPA without their shared Root CA
by Alexander Petrenz 23 Mar '20

23 Mar '20

Hi, I'm new to FreeIPA and I have a conceptual question. I have an existing PKI-Infrastructure with one root CA and three derived Sub-CAs. Now I want to change the PKI-Management to FreeIPA without replacing the already existing Sub-CAs. My first question is: Is it possible to have more then one external CAs (by the installation with "external-ca") in FreeIPA? The goal is to import the three existing external Sub-CAs with their keys in FreeIPA. I have found various sources from around 2015 that such a feature will be implemented later but I didn't found any information if it is implemented yet - or not. Furthermore I don't want to import the root CA with its key into FreeIPA. As far I understood this would be a security benefit if the ipa server would be compromised. If that idea is wrong, I would be happy to get some advice on this. Thanks Alexander

4 8

FreeIPA ReadTheDocs site
by Alexander Bokovoy 23 Mar '20

23 Mar '20

Hi, Thanks to Christian Heimes' work, we now have auto-generated FreeIPA documentation at https://freeipa.readthedocs.io/en/latest/. It currently only includes in-tree design documents and FreeIPA workshop but more to come as older design pages and HOW TOs get converted to upstream git tree. If anyone wants to help with the conversion, please don't hesitate to contact me or Christian. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

2 2

Can't SSH to client after migrate
by Faraz Younus 23 Mar '20

23 Mar '20

Hello Team, I migrated freeipa client which is having 3.0 version to new freeipa server version 4.6 and host is successfully enrolled on new IPA server but I can not ssh into the client machine. ssh faraz.younus(a)client.example.com faraz.younus(a)client.example.com's password: Permission denied, please try again. Is this the version issue due to which I can't login via ssh ? Looking forward to your reply. Thanks Faraz

2 15

Samba file server authentication issues
by Michael Deffenbaugh 21 Mar '20

21 Mar '20

Hey all, I'm having issues getting a setting up a Samba file server using IPA as an authentication source on my network. I followed the guide based off of the mailing list chatter <https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA>. No success. When I try to authenticate using kerberos (or password), I get an access denied error on the client when running "smbclient -k -L fs01.svr.ipa.domain": session setup failed: NT_STATUS_ACCESS_DENIED And it tries to revert to local user lookup on the server: [2020/03/20 02:47:32.669898, 3] ../auth/kerberos/gssapi_pac.c:123(gssapi_obtain_pac_blob) gssapi_obtain_pac_blob: obtaining PAC via GSSAPI gss_get_name_attribute failed: The operation or option is not available or unsupported: No such file or directory [2020/03/20 02:47:32.670131, 3] ../auth/gensec/gensec_util.c:55(gensec_generate_session_info_pac) gensec_generate_session_info_pac: Unable to find PAC for mddeff@<IPA.DOMAIN>, resorting to local user lookup ------ Server Config ----- [global] workgroup = SVR realm = SVR.IPA.DOMAIN dedicated keytab file = /etc/samba/samba.keytab kerberos method = dedicated keytab use kerberos keytab = true log file = /var/log/samba/log.%m log level = 3 security = ads ---------- Client: Fedora 30 File Server: CentOS 7.7, Samba 4.9.1, ipa-client 4.6.5 selinux is enabled. Any thoughts? Thanks in advance! Regards, Mike

2 8

Web UI is slow and unresponsive
by Boyd Ako 20 Mar '20

20 Mar '20

So, I have a server setup with just three users and less than 10 systems attached to it. But, for some reason when I try to login via the webui it normally just hangs at the "Authenticating..." point. Sometimes if I'm lucky I actually get in to the interface. However, anything that I click on has the "working..." wheel of death and if it does load the data for the page it takes forever. Environment: -"At home" no production environment. - Home router is set to use internal BIND DNS server and the IPA server for DNS - IPA server is set to use the BIND DNS server for forwarding - BIND DNS server's primary function is Blackhole DNS forwarding server - IPA server is set to be an internal self-signed CA/RA Things I've tried: 1) reboot the server Result: No Change. 2) Tried using Chrome, Firefox, Safari, and Opera with cache clearing. Result: No Change 3) Tried logging in via User Name and password. Result: No change 4) Tried logging in via PKCS#11 soft-token. Result: No change 5) login to the IPA server, start kerberos session, and run `ipa user-find`. Result: command hangs 6) login to the IPA client, start kerberos session, and run `ipa user-find`. Result: command hangs When monitoring `journalctl -xf` when doing so the only things I see is things like the following: Mar 20 17:25:33 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete Mar 20 17:25:43 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete Mar 20 17:25:52 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete Mar 20 17:25:54 ipa.neverland.ddns.me ns-slapd[2810]: GSSAPI server step 1 Mar 20 17:25:54 ipa.neverland.ddns.me ns-slapd[2810]: GSSAPI server step 2 Mar 20 17:25:54 ipa.neverland.ddns.me ns-slapd[2810]: GSSAPI server step 3 Mar 20 17:25:57 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete Mar 20 17:25:59 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete Mar 20 17:26:05 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete Mar 20 17:26:25 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete Mar 20 17:26:27 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete Mar 20 17:26:28 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete 7) Tried to understand the log output of `journalctl -xf` when I do `systemctl restart ipa`, which can be found at https://pastebin.com/7sMAp7Zh 8) Tried using curl with kerberos to access Web API. Result: No change. Note: This and all other web-based access sometimes errors out with a vague "Internal Error" message.

1 0

Re: freeIPA in a complex multi-subnet, multi-domain, multi-identity provider lab environment
by Todd Grayson 20 Mar '20

20 Mar '20

Thanks Rob, Thanks Angus, I am aware of how to point the client to the specific IPA server, what I'm struggling more with is freeIPA in an environment where its not using DNS for domain and realm resolution for kerberos, which does work today. I should have limited my question to the following: Is it possible to use ipaClient but manage static mappings in the krb5.conf [realm] and [domain realm] and run with dns_lookup_kdc=false and dns_lookup_realm=false (including the krb5.conf on the ipa server itself so its aware of all). The question from Angus makes me believe that having the dns_lookup* = false is a unsupported context in an IPA environment. Thanks for your feedback.

6 8

Ansible and Kerberos
by Kimmo Rantala 20 Mar '20

20 Mar '20

Hi, I searched the interwebs but didn't find definite answer. We are enrolling clients with ansible like this: shell: ipa-client-install -U {{ ipa_extra_params }} --domain={{ ipa_domain }} --principal={{ ipa_admin_user }} --password={{ ipa_admin_password }} --mkhomedir --force-join --hostname={{ instance_hostname.stdout }}.{{ ipa_domain }} This works fine. After enrolling we want to edit the attributes of the newly enrolled host. We do that like this: shell: echo {{ ipa_admin_password }} | kinit enroller@{{ ipa_domain|upper }} && ipa host-mod --setattr=userclass="{{ host_user_class }}" {{ instance_hostname.stdout }}.{{ ipa_domain }} This also works fine but we don't love the fact that we echo the password to kinit. I know that there is the keytab route but that would require moving the keytab file to the host first. While this is not in any way impossible, we would like to "see all the cards". What would be the best practice(tm) for this?

4 5

Ubuntu client: Kerberos works, authentication does not
by Nicholas DeMarco 20 Mar '20

20 Mar '20

Hello, I've worked through many issues learning and implementing FreeIPA in my realm. Thanks to many for the helpful direction. One Ubuntu client is not behaving. It joined successfully, but will not authenticate. Kerberos works: # kinit ndemarco # klist Ticket cache: KEYRING:persistent:0:0 Default principal: ndemarco(a)PCHEM.PRO Valid starting Expires Service principal 03/07/2020 12:20:20 03/08/2020 13:20:17 krbtgt/PCHEM.PRO(a)PCHEM.PRO However, I cannot login as the same user. The password is not recognized. No local user with the same name: # getent passwd | grep ndemarco None of the SSSD logs show anything interesting. I'm a learner. Please give me a hint++ on where to look next. Sincerely, Nick

3 2

external users trust AD in the foreman
by Natxo Asenjo 19 Mar '20

19 Mar '20

hi, according to the satellite documentation ( https://access.redhat.com/documentation/en-us/red_hat_satellite/6.4/html/ad…) this should work, but it's a bit unclear as to how. Let's see, we have a cross realm trust between an AD (2016) and RHEL 7.7. I have an external group mapped in IdM to an AD group, I can login using ssh with my AD user to the host running the foreman which is member of IdM (not satellite, I know, but we require some functionality in the foreman not available in satellite). So far so good. But what exactly do I need to do now? According to the manual: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.4/html/ad… 13.3.6. Configuring the IdM Server to Use Cross-Forest Trust On the IdM server, configure the server to use cross-forest trust. *Procedure* 1. Enable HBAC: 1. Create an external group and add the AD group to it. 2. Add the new external group to a POSIX group. 3. Use the POSIX group in a HBAC rule. 2. Configure sssd to transfer additional attributes of AD users. - Add the AD user attributes to the *nss* and *domain* sections in /etc/sssd/sssd.conf. For example: [nss] user_attributes=+mail, +sn, +givenname [domain/EXAMPLE] ldap_user_extra_attrs=mail, sn, givenname So I have the external group mapped to a posix group, I can login with my AD user so that takes care of 1. a) 1 b) and 1 c). Point 2 means I need to modify sssd.conf in the foreman host, I think. And then? -- Groeten, natxo

1 1

A fix for stuck certificates with the "NEWLY_ADDED_NEED_KEYINFO_READ_PIN" status
by Sam Morris 19 Mar '20

19 Mar '20

I noticed that a certificate request on a CentOS 8 server (running ipa- server 4.8.0-13.module_el8.1.0+265+e1e65be4) got stuck: Request ID '20200123083218': status: NEWLY_ADDED_NEED_KEYINFO_READ_PIN stuck: yes key pair storage: type=FILE,location='/var/lib/ipa/private/httpd.key' certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt' CA: IPA issuer: CN=Certificate Authority,O=IPA.EXAMPLE.COM subject: CN=ipa2.ipa.example.com,O=IPA.EXAMPLE.COM expires: 2021-12-19 18:32:27 UTC dns: ipa2.ipa.example.com principal name: HTTP/ipa2.ipa.example.com(a)IPA.EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes I was able to fix this with the following command: # ipa-getcert start-tracking -i 20200123083218 -p /var/lib/ipa/passwds/ipa2.ipa.example.com-443-RSA Hopefully someone else will find that useful. (Thanks to Rob for his advice in [0]; the command I used modified the existing request without having to delete and re-create it from scratch.) [0] https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2020