May 2020 - FreeIPA-users - Fedora mailing-lists

Reverse DNS zones with AD Trust
by Vinícius Ferrão 23 May '20

23 May '20

Hello, I would like to know how to handle reverse DNS zones when AD trust is enabled. I do have separate domains for AD and IPA as required, but the reverse zones are mixed, since the hosts are on the same network, which is common. In this scenario where should the reverse DNS zone be hosted? On the AD side? On IPA? How to make this work without breaking dynamic DNS updates for the PTR zones? Should any of them keep the zones as slaves? There’s some older discussions here on the list but without continuity and I don’t know the results, like this one: https://www.redhat.com/archives/freeipa-users/2015-June/msg00555.html In this old thread, the recommendation was to move the reverse zone to IPA and make some grants on BIND to allow Dynamic DNS updates. But is this still the case? There’s any oficial guidance in this issue? This scenario is supported or I must have separate networks, even with VLANs and IP addresses, for *nix and Windows clients? Thanks,

2 3

kernel: ns-slapd[5865]: segfault at 5603c0ee2000 ip 00007fe3ba3975ba sp 00007fe3bdbd28a8 error 4 in libc-2.17.so[7fe3ba242000
by TomK 23 May '20

23 May '20

Hey All, I've upgrade one side of my two node cluster. However, the secondary won't come even though the manual upgrade apparently went well. [root@idmipa04 ~]# ipa-server-upgrade Upgrading IPA:. Estimated time: 1 minute 30 seconds [1/9]: saving configuration [2/9]: disabling listeners [3/9]: enabling DS global lock [4/9]: disabling Schema Compat [5/9]: starting directory server [6/9]: updating schema [7/9]: upgrading server [8/9]: stopping directory server [9/9]: restoring configuration Done. Update complete Upgrading IPA services Upgrading the configuration of the IPA services IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. Unexpected error - see /var/log/ipaupgrade.log for details: CalledProcessError: Command '/bin/systemctl start dirsrv(a)MWS-MDS-XYZ.service' returned non-zero exit status 1 The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information [root@idmipa04 ~]# Additional information: [root@idmipa04 ~]# cat /var/log/ipaupgrade.log|tail -n 50 2020-05-19T04:18:10Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2020-05-19T04:18:10Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2020-05-19T04:18:10Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2020-05-19T04:18:10Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2020-05-19T04:18:10Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2020-05-19T04:18:10Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2020-05-19T04:18:10Z DEBUG duration: 0 seconds 2020-05-19T04:18:10Z DEBUG Done. 2020-05-19T04:18:10Z INFO Update complete 2020-05-19T04:18:10Z INFO Upgrading the configuration of the IPA services 2020-05-19T04:18:10Z DEBUG IPA version 4.6.6-11.el7.centos 2020-05-19T04:18:10Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index' 2020-05-19T04:18:10Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2020-05-19T04:18:10Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index' 2020-05-19T04:18:10Z DEBUG Starting external process 2020-05-19T04:18:10Z DEBUG args=/bin/systemctl is-active dirsrv(a)MWS-MDS-XYZ.service 2020-05-19T04:18:10Z DEBUG Process finished, return code=3 2020-05-19T04:18:10Z DEBUG stdout=unknown 2020-05-19T04:18:10Z DEBUG stderr= 2020-05-19T04:18:10Z DEBUG Starting external process 2020-05-19T04:18:10Z DEBUG args=/bin/systemctl start dirsrv(a)MWS-MDS-XYZ.service 2020-05-19T04:19:55Z DEBUG Process finished, return code=1 2020-05-19T04:19:55Z DEBUG stdout= 2020-05-19T04:19:55Z DEBUG stderr=Job for dirsrv(a)MWS-MDS-XYZ.service failed because a fatal signal was delivered to the control process. See "systemctl status dirsrv(a)MWS-MDS-XYZ.service" and "journalctl -xe" for details. 2020-05-19T04:19:56Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2020-05-19T04:19:56Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 54, in run server.upgrade() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 2166, in upgrade upgrade_configuration() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1791, in upgrade_configuration ds.start(ds_serverid) File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 656, in start super(DsInstance, self).start(*args, **kwargs) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 464, in start self.service.start(instance_name, capture_output=capture_output, wait=wait) File "/usr/lib/python2.7/site-packages/ipaplatform/redhat/services.py", line 136, in start instance_name, capture_output=capture_output, wait=wait) File "/usr/lib/python2.7/site-packages/ipaplatform/base/services.py", line 303, in start skip_output=not capture_output) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 563, in run raise CalledProcessError(p.returncode, arg_string, str(output)) 2020-05-19T04:19:56Z DEBUG The ipa-server-upgrade command failed, exception: CalledProcessError: Command '/bin/systemctl start dirsrv(a)MWS-MDS-XYZ.service' returned non-zero exit status 1 2020-05-19T04:19:56Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: CalledProcessError: Command '/bin/systemctl start dirsrv(a)MWS-MDS-XYZ.service' returned non-zero exit status 1 2020-05-19T04:19:56Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information [root@idmipa04 ~]# [root@idmipa04 ~]# [root@idmipa04 ~]# [root@idmipa04 ~]# [root@idmipa04 ~]# /bin/systemctl start dirsrv(a)MWS-MDS-XYZ.service [root@idmipa04 ~]# [root@idmipa04 ~]# [root@idmipa04 ~]# systemctl status dirsrv(a)MWS-MDS-XYZ.service ● dirsrv(a)MWS-MDS-XYZ.service - 389 Directory Server MWS-MDS-XYZ. Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled; vendor preset: disabled) Active: active (running) since Tue 2020-05-19 00:21:49 EDT; 10s ago Process: 4657 ExecStartPre=/usr/sbin/ds_systemd_ask_password_acl /etc/dirsrv/slapd-%i/dse.ldif (code=exited, status=0/SUCCESS) Main PID: 4664 (ns-slapd) Status: "slapd started: Ready to process requests" CGroup: /system.slice/system-dirsrv.slice/dirsrv(a)MWS-MDS-XYZ.service └─4664 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-MWS-MDS-XYZ -i /var/run/dirsrv/slapd-MWS-MDS-XYZ.pid May 19 00:21:49 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:49.380321307 -0400] - ERR - set_krb5_creds - ...ealm) May 19 00:21:49 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:49.381268146 -0400] - ERR - NSMMReplicationPl...r) () May 19 00:21:49 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:49.602418963 -0400] - ERR - schema-compat-plu...onds! May 19 00:21:52 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:52.607265030 -0400] - ERR - set_krb5_creds - ...ealm) May 19 00:21:52 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:52.609340757 -0400] - ERR - set_krb5_creds - ...ealm) May 19 00:21:54 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:54.625706606 -0400] - ERR - schema-compat-plu...c=xyz May 19 00:21:54 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:54.758965595 -0400] - ERR - schema-compat-plu...c=xyz May 19 00:21:54 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:54.759530547 -0400] - ERR - schema-compat-plu...tion. May 19 00:21:58 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:58.612054116 -0400] - ERR - set_krb5_creds - ...ealm) May 19 00:21:58 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:58.613830783 -0400] - ERR - set_krb5_creds - ...ealm) Hint: Some lines were ellipsized, use -l to show in full. [root@idmipa04 ~]# [root@idmipa04 ~]# [root@idmipa04 ~]# [root@idmipa04 ~]# systemctl status dirsrv(a)MWS-MDS-XYZ.service -l ● dirsrv(a)MWS-MDS-XYZ.service - 389 Directory Server MWS-MDS-XYZ. Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled; vendor preset: disabled) Active: active (running) since Tue 2020-05-19 00:21:49 EDT; 16s ago Process: 4657 ExecStartPre=/usr/sbin/ds_systemd_ask_password_acl /etc/dirsrv/slapd-%i/dse.ldif (code=exited, status=0/SUCCESS) Main PID: 4664 (ns-slapd) Status: "slapd started: Ready to process requests" CGroup: /system.slice/system-dirsrv.slice/dirsrv(a)MWS-MDS-XYZ.service └─4664 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-MWS-MDS-XYZ -i /var/run/dirsrv/slapd-MWS-MDS-XYZ.pid May 19 00:21:52 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:52.607265030 -0400] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/idmipa04.mws.mds.xyz(a)MWS.MDS.XYZ] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) May 19 00:21:52 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:52.609340757 -0400] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/idmipa04.mws.mds.xyz(a)MWS.MDS.XYZ] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) May 19 00:21:54 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:54.625706606 -0400] - ERR - schema-compat-plugin - warning: no entries set up under cn=ng, cn=compat,dc=mws,dc=mds,dc=xyz May 19 00:21:54 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:54.758965595 -0400] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=mws,dc=mds,dc=xyz May 19 00:21:54 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:54.759530547 -0400] - ERR - schema-compat-plugin - Finished plugin initialization. May 19 00:21:58 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:58.612054116 -0400] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/idmipa04.mws.mds.xyz(a)MWS.MDS.XYZ] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) May 19 00:21:58 idmipa04.mws.mds.xyz ns-slapd[4664]: [19/May/2020:00:21:58.613830783 -0400] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/idmipa04.mws.mds.xyz(a)MWS.MDS.XYZ] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) May 19 00:22:03 idmipa04.mws.mds.xyz ns-slapd[4664]: GSSAPI server step 1 May 19 00:22:03 idmipa04.mws.mds.xyz ns-slapd[4664]: GSSAPI server step 2 May 19 00:22:03 idmipa04.mws.mds.xyz ns-slapd[4664]: GSSAPI server step 3 [root@idmipa04 ~]# [root@idmipa04 ~]# --------------------------------------------------------------------- Looking at the service, appears libc hit a SEGFAULT. [root@idmipa04 ~]# journalctl -xe May 19 00:34:03 idmipa04.mws.mds.xyz Keepalived_vrrp[5424]: /usr/bin/killall -0 haproxy exited with status 1 May 19 00:34:05 idmipa04.mws.mds.xyz Keepalived_vrrp[5424]: /usr/bin/killall -0 haproxy exited with status 1 May 19 00:34:06 idmipa04.mws.mds.xyz ns-slapd[5745]: [19/May/2020:00:34:06.272901079 -0400] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRU May 19 00:34:06 idmipa04.mws.mds.xyz kernel: ns-slapd[5865]: segfault at 5603c0ee2000 ip 00007fe3ba3975ba sp 00007fe3bdbd28a8 error 4 in libc-2.17.so[7fe3ba242000 May 19 00:34:06 idmipa04.mws.mds.xyz systemd[1]: dirsrv(a)MWS-MDS-XYZ.service: main process exited, code=killed, status=11/SEGV May 19 00:34:06 idmipa04.mws.mds.xyz systemd[1]: Failed to start 389 Directory Server MWS-MDS-XYZ.. -- Subject: Unit dirsrv(a)MWS-MDS-XYZ.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit dirsrv(a)MWS-MDS-XYZ.service has failed. -- -- The result is failed. Wondering what should my next steps be from here? -- Thx, TK.

2 2

Error migrating LDAP passwords using sssd
by Pierre Ossman 22 May '20

22 May '20

Hi, We're in the process of migrating from an OpenLDAP server to FreeIPA. As such the issue of password migration of course shows up. Unfortunately the automatic migration in sssd is not working and we could use some help. Server is a RHEL 8 set up using ipa-server-install and data migrated from OpenLDAP using ipa migrate-ds. Client is a Fedora 32 set up using ipa-client-install. User lookup works fine, but trying to authenticate gives us this: > May 22 15:11:26 samuel.lkpg.cendio.se sshd[3213]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=ossman > May 22 15:11:26 samuel.lkpg.cendio.se sshd[3213]: pam_sss(sshd:auth): received for user ossman: 17 (Failure setting user credentials) Nothing in the journal from sssd or in its own log files when this happens. Turning up the logging to 6 gives me a lot more, among it this: > (Fri May 22 15:12:45 2020) [[sssd[krb5_child[3262]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [CENDIO.SE] > (Fri May 22 15:12:45 2020) [[sssd[krb5_child[3262]]]] [get_and_save_tgt] (0x0020): 1704: [-1765328174][Generic preauthentication failure] > (Fri May 22 15:12:45 2020) [[sssd[krb5_child[3262]]]] [map_krb5_error] (0x0020): [1432158222][Failure setting user credentials]. > (Fri May 22 15:12:45 2020) [[sssd[krb5_child[3262]]]] [k5c_send_data] (0x0200): Received error code 1432158222 Red Hat's documentation suggest an error called "key type is not supported" should be given, so is this perhaps the issue? Not sure where to continue here. I've checked the ldap entries an they lack "krbprincipalkey" but have "userpassword", which I understand is correct for my situation. Regards -- Pierre Ossman Software Development Cendio AB https://cendio.com Teknikringen 8 https://twitter.com/ThinLinc 583 30 Linköping https://facebook.com/ThinLinc Phone: +46-13-214600 A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

2 2

Auditing screensavers
by Bret Wortman 21 May '20

21 May '20

I have a need to set up an audit rule that will track whenever a user's screensaver is unlocked via password. I've tried setting a watch on pam_sss.so but that gets a lot more than what I strictly need and that also, strangely, had a tendency to audit when the screensaver was activated but not when it was deactivated. Has anyone done this successfully in a way that can be shared? Our users are on both gnome & kde and could potentially be using one of several screensavers. Thanks, -- Bret Wortman bret.wortman(a)damascusgrp.com

1 0

Question regarding DNSSEC + AD Trust
by Vinícius Ferrão 20 May '20

20 May '20

Hello, This may sound like a noobish question, but how can I make DNSSEC play nicely when the external domain have DNSSEC enabled and this makes internal zones failing when creating an AD trust, since we are using subdomains for our LAN? Our case: example.com (External DNS name with DNSSEC enabled) win.example.com (Active Directory Zone) nix.example.com (FreeIPA Zone) Even with the correct conditional forwarders set up in Windows DNS and FreeIPA DNS, DNSSEC kicks in and fail resolutions. I _MUST_ disable DNSSEC? There’s another way? Thanks,

2 4

Standard Linux Tools and Indirect Group Membership
by Mark Potter 20 May '20

20 May '20

While I have seen similar posts to the list while digging through the archive, I cannot find this question specifically answered. We are coming from OpenLDAP and migrating to FreeIPA on CentOS 7.5. We are using indirect memberships to make this migration easier as we are moving from an organically grown OpenLDAP to a very structured FreeIPA implementation. What seems to be happening is that indirect memberships don't show using the standard Linux tools. Using either "id" or "groups" doesn't show any indirect memberships yet the permissions seem to still work properly. This is causing some confusion with our team. Group B is a member of Group A and the user is also a direct member of groups C and D. When using "id" for a given user it returns B, C, D and not A. However I can create a file owned by user root and group A with 550 permissions and the user can view the contents of the file. "ipa user-show" shows the proper memberships with A being an indirect membership. Is this the expected behavior when using indirect memberships? If so, does one abandon the standard CLI tool and use only ipa commands? I am fully aware this could be a configuration issue but I have yet to find the correct configuration to expose indirect membership to the standard Linux tools. -- Regards, Mark L. Potter

3 5

Announcing SSSD 2.3.0
by Pavel Březina 19 May '20

19 May '20

# SSSD 2.3.0 The SSSD team is proud to announce the release of version 2.3.0 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/sssd-2_3_0 See the full release notes at: https://sssd.github.io/docs/users/relnotes/notes_2_3_0 RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### New features - SSSD can now handle `hosts` and `networks` nsswitch databases (see `resolve_provider` option) - By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see `pam_initgroups_scheme` option) - OpenSSL is used as default crypto provider, NSS is deprecated - Active Directory provider now defaults to GSS-SPNEGO SASL mechanism (see `ldap_sasl_mech` option) - Active Directory provider can now be configured to use only `ldaps` port (see `ad_use_ldaps` option) - SSSD now accepts host entries from GPO's security filter - Format of debug messages has changed to be shorter and better sortable - New debug level (`0x10000`) was added for low level ldb messages only (see `sssd.conf` man page) ### Packaging changes - New configure option `--enable-gss-spnego-for-zero-maxssf` ### Documentation Changes - Default value of `ldap_sasl_mech` has changed to `GSS-SPNEGO` for AD provider - Return code of `pam_sss.so` are documented in `pam_sss` manpage - Added option `ad_update_samba_machine_account_password` - Added option `ad_use_ldaps` - Added option `ldap_iphost_object_class` - Added option `ldap_iphost_name` - Added option `ldap_iphost_number` - Added option `ldap_ipnetwork_object_class` - Added option `ldap_ipnetwork_name` - Added option `ldap_ipnetwork_number` - Added option `ldap_iphost_search_base` - Added option `ldap_ipnetwork_search_base` - Added option `ldap_connection_expire_offset` - Added option `ldap_sasl_maxssf` - Added option `pam_initgroups_scheme` - Added option `entry_cache_resolver_timeout` - Added option `entry_cache_computer_timeout` - Added option `resolver_provider` - Added option `proxy_resolver_lib_name` - Minor text improvements

1 0

ssh bash completion (no known_hosts)
by Klaus Vink Slott 15 May '20

15 May '20

Hi I am playing around in my lab with a set of centos 8 and centos 7 VM's trying to make automount do some magic. All client VM's is fully IPA integrated - and that it seems to make bash completion unavailable when I hit TAB to complete the fqdn after ssh [hostname].. I guess that this is due to there is no .ssh/known_hosts in a ipa integrated client. But at the same time it is really annoying that to satisfy kerberos, I have to type the fqdn at the ssh prompt every time. So before I start building my own bash completion something, I would like to know if any of you have knowledge of a easy solution, some pre-boiled howto, rpm or else? -- Regards Klaus

4 5

IPA CA renewal and duplicate CA certs
by Sigbjorn Lie 15 May '20

15 May '20

Hi, We recently renewed our IPA CA cert using the "ipa-cacert-manage renew” command. The renewal was successful, and our CA cert no longer expires in 2020, but in 2040. Running “ipa-certupdate” on existing IPA clients and ipa-client-install on new IPA clients also works, however both the new and the old CA cert is pulled down to the IPA client and stored in /etc/ipa/ca.crt. This creates some issues as most applications reading /etc/ipa/ca.crt only reads the first entry, which happens to be the old CA cert. For the moment everything works OK as the old CA cert is still valid, however this will become a major issue in a few months time. Is this expected? To continue to service both the old and the new CA certificate to old and new IPA clients? Will the old certificate be automatically removed at some point? If not, what is the safe steps to remove the old CA certificate from the IPA servers? Thanks. Regards, Siggi

5 17

3rd Party OTP for LDAP and Kerberos
by Russ Long 14 May '20

14 May '20

I'm being forced by management to use a 3rd part OTP service for all authentication in our FreeIPA system, including LDAP connections. I know this can be at least partially done with Radius, however I'm not having much luck with that. I've got a radius proxy setup, and user assigned to it, however it is not ever prompting for the MFA through RADIUS. Additionally the tooltips for auth types state that radius does not work with LDAP connections.

2 10

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2020