July 2020 - FreeIPA-users - Fedora mailing-lists

Docker using PAM on a freeipa host?
by Dominik Vogt 05 Aug '20

05 Aug '20

We have a freeipa server and some clients. One of the clients runs a (minimal) Docker container with some custom application. The application does user authorization and authentication using PAM. Is there a good way to make PAM delegate all decisions to the host running the Docker conainer? We'd like to avoid configuring the container as a separate freeipa client. Ciao Dominik ^_^ ^_^ -- Dominik Vogt

2 3

DNS Delegation
by Christian Hernandez 04 Aug '20

04 Aug '20

I'm having an issue delegating a subdomain. My domain is cloud.chx and I ran the following. ipa dnsrecord-add cloud.chx dc1.ad --a-rec=192.168.1.253 ipa dnsrecord-add 1.168.192.in-addr.arpa. 253 --ptr-rec=dc1.ad.cloud.chx. ipa dnsrecord-add cloud.chx ad --ns-rec=dc1.ad.cloud.chx. I checked and it's in the config [root@ipa1 ~]# dig axfr cloud.chx | grep ad ad.cloud.chx. 86400 IN NS dc1.ad.cloud.chx. dc1.ad.cloud.chx. 86400 IN A 192.168.1.253 But when I query, it doesn't return what I expected. [root@ipa1 ~]# dig dc1.ad.cloud.chx NS ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> dc1.ad.cloud.chx NS ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 15346 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;dc1.ad.cloud.chx. IN NS ;; Query time: 27 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Thu Jul 30 15:48:03 PDT 2020 ;; MSG SIZE rcvd: 45 The other DNS server is up and running. [root@ipa1 ~]# dig @192.168.1.253 dc1.ad.cloud.chx ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> @192.168.1.253 dc1.ad.cloud.chx ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64777 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;dc1.ad.cloud.chx. IN A ;; ANSWER SECTION: dc1.ad.cloud.chx. 3600 IN A 192.168.1.253 ;; Query time: 1 msec ;; SERVER: 192.168.1.253#53(192.168.1.253) ;; WHEN: Thu Jul 30 15:59:21 PDT 2020 ;; MSG SIZE rcvd: 61 This is worth noting that adding +norec works. [root@ipa1 ~]# dig dc1.ad.cloud.chx NS +norec ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> dc1.ad.cloud.chx NS +norec ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36273 ;; flags: qr ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;dc1.ad.cloud.chx. IN NS ;; AUTHORITY SECTION: ad.cloud.chx. 86400 IN NS dc1.ad.cloud.chx. ;; ADDITIONAL SECTION: dc1.ad.cloud.chx. 86400 IN A 192.168.1.253 ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Thu Jul 30 15:59:39 PDT 2020 ;; MSG SIZE rcvd: 75 Is there anything I'm missing? --- Christian Hernandez, RHCE Principal Technical Marketing Manager - Cloud Platforms Red Hat, Inc <https://www.redhat.com/> christian(a)redhat.com Mobile: 626.502.8310 Slack: chernand <https://www.redhat.com/>

4 7

Some users get sshd:auth Permission denied
by TOULMONDE Sébastien (CSC/MST) 03 Aug '20

03 Aug '20

Hi, Yesterday we migrated our dev servers to IPA - to help in the migration, I enabled the allow_all HBAC rule, but despite that, some users get this message: Jul 29 15:56:23 el4966 sshd[98029]: Postponed keyboard-interactive for id094844 from 81.245.6.11 port 35552 ssh2 [preauth] Jul 29 15:56:49 el4966 sshd[98034]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=el1921.bc user=id094844 Jul 29 15:56:49 el4966 sshd[98034]: pam_sss(sshd:auth): received for user id094844: 6 (Permission denied) < ----- This Jul 29 15:56:52 el4966 sshd[98029]: error: PAM: Authentication failure for id094844 from el1921.bc Jul 29 15:56:52 el4966 sshd[98029]: Failed keyboard-interactive/pam for id094844 from 81.245.6.11 port 35552 ssh2 Jul 29 15:56:58 el4966 sshd[98029]: Postponed keyboard-interactive for id094844 from 81.245.6.11 port 35552 ssh2 [preauth] Jul 29 15:57:00 el4966 sshd[98029]: Connection closed by 81.245.6.11 port 35552 [preauth] These are external (AD) users. Weird thing: not all users have this and not everywhere... I tried to remove the LDAP filter on the IPA server -> same thing... I'm running out of ideas... Thanks for your help! S. Toulmonde Sensitivity: Internal Use Only This e-mail cannot be used for other purposes than Proximus business use. See more on https://www.proximus.be/maildisclaimer

2 1

AD trust user logins where their userPrincipalName does not match AD's DNS domain name
by Sam Morris 03 Aug '20

03 Aug '20

I have a FreeIPA setup that trusts an Active Directory domain. I have users who exist in the AD domain, but who are unable to log into Linux systems. The domains are: ad.domain.examaple: the Active Directory domain ipa.ad.domain.example: the FreeIPA domain The user has a SAM-Account-Name of 'user.name' and a userPrincipalName of 'user.name(a)thirdparty.com'. Here are the log messages I see when one of them tries to log in: ==> krb5_child.log <== (Thu Jul 23 11:08:58 2020) [[sssd[krb5_child[2481132]]]] [get_and_save_tgt] (0x0020): 1704: [-1765328378][Client 'user.name\@THIRDPARTY.COM@IPA.AD.DOMAIN.EXAMPLE' not found in Kerberos database] (Thu Jul 23 11:08:58 2020) [[sssd[krb5_child[2481132]]]] [map_krb5_error] (0x0020): 1833: [-1765328378][Client 'user.name\@THIRDPARTY.COM@IPA.AD.DOMAIN.EXAMPLE' not found in Kerberos database] ==> sssd_ipa.ad.domain.example.log <== (Thu Jul 23 11:08:58 2020) [sssd[be[ipa.ad.domain.example]]] [krb5_auth_done] (0x0040): The krb5_child process returned an error. Please inspect the krb5_child.log file or the journal for more information A bit of research brings me to <https://docs.microsoft.com/en-us/windows/win32/ad/naming-properties> which states: A UPN suffix has the following restrictions: It must be the DNS name of a domain, but does not need to be the name of the domain that contains the user. It must be the name of a domain in the current domain forest, or an alternate name listed in the upnSuffixes attribute of the Partitions container within the Configuration container. I believe the user account violates the second of these restrictions, in that its suffix (thirdparty.com) is neither in the AD forest, nor is it found in the upnSuffixes attribute of CN=Partitions,CN=Configuration,DC=ad,DC=domain,DC=example in AD. Now the ugly part. I suspect this is just How Things Are Done around here and getting the user's userPrincipalName changed to ad.domain.example will not be particularly easy. So in the meantime, is there any configuration I can do, either on the FreeIPA servers or on the machine where the user needs to log in, to work around the UPN suffix mismatch? I am able to get a TGT for the user with 'kinit user.name(a)AD.DOMAIN.EXAMPLE', so I guess I'm looking for a hypothetical way to tell sssd to map the UPN suffix in the user's domain (thirdparty.com) to ad.domain.example when it tries to get a ticket during user login... I can also ask to get thirdparty.com added to the AD domain's list of UPN suffixes. Can anyone confirm whether this would be sufficient to get sssd to be able to authenticate the user? Thanks! -- Sam Morris <https://robots.org.uk/>

2 1

Centos 8.2.2004 (Core) not pulling FreeIPA 4.8
by Damjan Kumin 03 Aug '20

03 Aug '20

Hello guys, regardless what officially I do, my Centos is not pulling latest FreeiPA binaries to install, it sticks with 4.7 Since everything is working, it is not a deal-breaker, but still, now that everything is stable and config is absolutely correct, it would be time to upgrade and stay up to date with all fixes. Any help on this topic please? Thanks in advance! rgD

3 5

autofs Troubles
by Ronald Wimmer 30 Jul '20

30 Jul '20

Hi, all over sudden automounting home shares has stopped working on one of our most important servers. The configuration has not changed at all. Automounting on servers with identical configuration works. What i tried so far: 1) stopping rpcidmapd, rpcgssd, autofs, sssd and restarting the services 2) rebooting the system 3) doing ipa-client-automount --uninstall and reconfiguring it again 4) checking /etc/sysconfig/nfs and /etc/idmapd.conf as well as sssd.conf 5) automount -fv tells me that it attemts to mount /home but nothing happens No matter what I tried I could not get homeshares mounted again. I would highly appreciate any input that brings me one step further. Cheers, Ronald

2 2

ssh session timeout on freeipa clients
by Saurabh Garg 28 Jul '20

28 Jul '20

Hi, Can someone please help me find an option if IdM server allows to control the ssh session timeout for user logins on freeipa clients? thanks, sgarg

2 1

FreeIPA CA failing to login with new admin user
by Stasiek Michalski 27 Jul '20

27 Jul '20

Hello, I installed FreeIPA replica on 4.8.4 on CentOS 8 from 4.4.4 from Fedora 25 with `ipa-replica-install --setup-dns --auto-forwarders`, without `--setup-ca` due to errors, which went fine. I do want to install CA though, which failed when I did `--setup-ca` and then later `ipa-ca-install` with the following error: ``` [4/29]: creating installation admin user Unable to log in as uid=admin-freeipa2.infra.opensuse.org,ou=people,o=ipaca on ldap://freeipa.infra.opensuse.org:389 [hint] tune with replication_wait_timeout [error] NotFound: uid=admin-freeipa2.infra.opensuse.org,ou=people,o=ipaca did not replicate to ldap://freeipa.infra.opensuse.org:389 Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ``` Obviously I did try try extending the timeout based on that, but I don't think that was helpful in the end, considering the logs produced by the old server: httpd access_log ``` 192.168.47.90 - - [23/Jul/2020:00:25:36 +0000] "GET /ca/rest/account/login HTTP/1.1" 401 994 ``` server process in journal ``` SSLAuthenticatorWithFallback: Authenticating with BASIC authentication Invalid Credential. at com.netscape.cmscore.authentication.PasswdUserDBAuthentication.authenticate(PasswdUserDBAuthentication.java:167) at com.netscape.cms.realm.PKIRealm.authenticate(PKIRealm.java:63) at com.netscape.cms.tomcat.ProxyRealm.authenticate(ProxyRealm.java:78) at org.apache.catalina.authenticator.BasicAuthenticator.authenticate(BasicAuthenticator.java:94) at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.doSubAuthenticate(SSLAuthenticatorWithFallback.java:37) at com.netscape.cms.tomcat.AbstractPKIAuthenticator.doAuthenticate(AbstractPKIAuthenticator.java:98) at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.authenticate(SSLAuthenticatorWithFallback.java:47) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:579) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:620) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:502) at org.apache.coyote.ajp.AbstractAjpProcessor.process(AbstractAjpProcessor.java:877) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:684) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1539) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1495) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) SSLAuthenticatorWithFallback: Fallback auth header: WWW-Authenticate=Basic realm="Certificate Authority" SSLAuthenticatorWithFallback: Fallback auth return code: 401 SSLAuthenticatorWithFallback: Result: false ``` and from pki logs ``` Failed to authenticate as admin UID=admin-freeipa2.infra.opensuse.org. Error: netscape.ldap.LDAPException: error result (49) ``` I don't particularly know how to proceed from here, since those errors don't mean much to me. I see however it's not just me having issues with `ipa-ca-install` at least similar to this one (although by the looks of it, the reason is already different ;) Thanks in advance for trying, LCP [Stasiek] https://lcp.world/

2 4

Re: krbpasswordexpiration field gone from "ipa user-show" ?
by raymond.spangle＠verizon.com 27 Jul '20

27 Jul '20

The same thing has happened to me. It's in the --raw data, but not in --all. Everything was fine in CentOS 6.x, but CentOS 8.x bombed my scripts with this.

2 2

getting authentication token is no longer valid new one required error
by Kannappan M 27 Jul '20

27 Jul '20

Hi Team, we have cloned one of the linux server which is having ipa user ac lets say 1. server a 2.server b 3. server c 4.server a.1 (clone server) one user has been created in server a.1 , b and c i was able to login to from b to c and c to b but when i tried to login to server b to server a.1 or from c to server a.1 getting error as authentication failed error when i dig deep with the cat /var/log/secure getting message as authentication token is no longer valid; new one required (log messages in server c and server b) when i checked the logs in server a.1 (cat /var/log/secure) pam_sss(sshd:auth): authentication success ; logname= uid = 0 euid=0 tty=ssh ruser= rhost= server c user error:pam: user account has expired for USER from server c please help me to fix it Regards Kanna

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2020