March 2019 - FreeIPA-users - Fedora mailing-lists

sss_ssh_authorizedkeys returns nothing on client
by Charles Ulrich 11 Mar '19

11 Mar '19

Hello, good people of FreeIPA-users, Short version: I've run into an issue where a SSH public key authentication doesn't work on the FreeIPA client. When I run `sss_ssh_authorizedkeys <fully-qualified_user>` on the client, there is a brief hang (10-15 seconds, maybe?) and then it returns nothing. The same command run on the FreeIPA server does, however, correctly return the user's public key. Long version: The server is FreeIPA 4.6.4 on CentOS 7 (all packages up to date) with a one-way trust to active directory. The client is the ipa-server package version 4.7.0 on Ubuntu 18.04. I added a user to the "Default Trust View" override and pasted in the public key. The AD trust and client configuration seem to be working for the most part since I can log into the client with my AD username and password. It's just SSH public key authentication that doesn't work. As mentioned above, the `sss_ssh_authorizedkeys` command runs successfully on the server but not on the client. From the client logs, it looks like the client is having trouble communicating with the server somehow. I don't see anything that looks like errors in the server logs. A sanitized version of the client logs at debug_level 4 are here: https://paste.fedoraproject.org/paste/y3nyxeb13wZMzaQNemhCNQ The sssd.conf from the client is here: https://paste.fedoraproject.org/paste/SK3qx0EcF19ggtrmssYZnw I can provide more detailed logs to individuals. I double-checked the firewalls on both the client and server and it looks to me like all the necessary ports are open on both sides. I have done a bunch of Googling and reading of documentation but nothing so far has led me in the right direction. This is something that *was* working just fine on a test deployment a few weeks ago. As far as I can tell, everything is set up the same. Is there any other information I can provide? Thanks, Charles

2 4

3rd pary Certificate for HTTP and LDAP
by Ronald Wimmer 10 Mar '19

10 Mar '19

Today I was reading the documentation on https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP Is the Prerequisite step necessary if the CA (Digicert) is already trusted by the OS? Regards, Ronald

2 1

FreeIPA and laptop question
by Albert Szostkiewicz 10 Mar '19

10 Mar '19

Hi! If os login for domain user is verified by FreeIpa (which sets uid etc) what happens if I use ipa-client on laptop and be outside my network ? If I won't be able to connect to IPA for login verification, is there any kind of fallback ? Or should i make any specific settings for such situation ? (assuming that i don't have access to network at all) Cheers!

3 3

OTP + SSHKey/Certificate Authentication
by Callum Smith 08 Mar '19

08 Mar '19

Dear FreeIPA Gurus, I was wondering if it's possible to configure `sshd` such that for OTP based authentication the first factor could be passed as a ssh key or certificate. So specifically: The user's password would not be required for auth, only the key and OTP token. Is there a magic combination of AuthenticationMethods for `sshd_config` that would allow this to work? Regards, Callum -- Callum Smith Research Computing Core Wellcome Trust Centre for Human Genetics University of Oxford e. callum(a)well.ox.ac.uk<mailto:callum@well.ox.ac.uk>

2 1

list all users and their password expiration date?
by Anthony Jarvis-Clark 08 Mar '19

08 Mar '19

Hello Everyone, Is there a command line method to get a list of users and their password expiration date? Thanks! -Anthony

1 0

Multiple dot in hostname - DNS error
by Vivek Aggarwal 08 Mar '19

08 Mar '19

Our current implementation has multiple dots(.) names in the hostname ,details mentioned below & we're using below setting while configuring the IPA/Redhat IDM server with integrated DNS. Hostname : testing-infra-01-dal1.testing.stg.avtar.local realm_name: avtar.local domain_name: avtar.local Once the setup completes ., we're getting below error . We're suspecting its related to multiple dots in the hostname. Considering the fact we cannot rename these hostname , please suggest how to resolve it . Is there a possibility to resolve it or we have to install/configure BIND DNS separately. Does this error really prevents us from registering other machines within our environment having similar multi dot pattern in hostnames ? +++++++++++++++++++++ ipapython.dnsutil: DEBUG The DNS query name does not exist: testing-infra-01-dal1.testing.stg.avtar.local. ipaserver.dns_data_management: ERROR unable to resolve host name testing-infra-01-dal1.testing.stg.avtar.local. to IP address, ipa-ca DNS record will be incomplete ++++++++++++++++++++

4 14

FreeIPA and AD
by Kristian Petersen 07 Mar '19

07 Mar '19

Hello, Where I work we are a small shop. We are currently using just FreeIPA for authentication and DNS and other Linux management stuff that it does for us. We have enough Windows workstations now that it would be really nice to be able to manage those like we can our Linux stuff. From what I have read thus far, it seems that if you use FreeIPA with AD AD is the primary user store and FreeIPA kind of takes a back seat. I am looking for some help in better understanding the implications of using FreeIPA along with AD. Is there someone who could help me unravel this a bit or point me at some good resources? -- Kristian Petersen System Administrator BYU Dept. of Chemistry and Biochemistry

3 2

pki-tomcatd no longer working
by Sina Owolabi 07 Mar '19

07 Mar '19

Hi! I am running a small IPA domain (CentOS 7 servers, ipa version 4.5.4, api version 2.228), with one master, and two replicas, and I noticed that pki-tomcatd no longer works on the master, after attempting a reboot. pki-tomcatd works fine on the slaves. I noticed if I try to run IPA functions (dns record removal, hosts management, user passwords, etc), I receive responses like this: ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (Internal Server Error) But on the replicas, functions work fine. Please can someone guide me on how to fix this?

4 15

Re: Squid proxy digest authentication
by Edward Valley 06 Mar '19

06 Mar '19

3 12

Re: Lost IPA master Left with replica only
by Rob van Halteren 06 Mar '19

06 Mar '19

thanks for the hint. I ran stuck during the search for the needed files in /var/lib/pki-ca/conf/CS.cfg on the master in the CS.cfg file the related ca.crl items do not exist. and the ca.listenToCloneModifications=true. This would implicate that its not the ca-master. Unfortunately it is the ca-master. Appart from this, I also was not able to install a CA on the replica with ipa-ca-install. I abbondoned the effort to promote this replica and decided to install a new ipa-server. This leads to an other problems for which i will open a new tread. Regards, Rob. <http://www.linkedin.com/company/filmmore-amsterdam/>

1 0

IPA server on multiple subzones
by Callum Smith 05 Mar '19

05 Mar '19

Dear All, We have a number of DNS sub zones in different IP subnets, and we want to ensure that DNS queries respond quickly and aren't waiting for timeouts. So as such we're thinking of putting our IPA on multiple interfaces, one in each sub zone, and registering the host and it's clients within that sub zone separately. To achieve this we need to add principal aliases for each sub zone to the IPA services - which appears to be working well so far, but I have a question: what's the best way to setup a new certificate for the web interface to allow SSL on the new sub zone interface. We're thinking of simply adding alt names to the certificate and getting a newly issued one from the local CA. Should we be looking to do this exclusively with certutil or should we be using ipa-server-certinstall. I hope that this makes sense and our approach isn't complete madness. Regards, Callum -- Callum Smith Research Computing Core Wellcome Trust Centre for Human Genetics University of Oxford e. callum(a)well.ox.ac.uk<mailto:callum@well.ox.ac.uk>

1 0

Adding the attribute jpegPhoto to the default attributes list
by Boudjoudad Abdelkader 04 Mar '19

04 Mar '19

photHello, I added the attribute jpegPhoto of the objectclass inetOrgPerson to a user and set it with a path to a picture, is there a way to add this attribute the the default attributes list ? Thanks,

1 0

Very slow response from Web UI and command line on master server
by Alex Georgopoulos 04 Mar '19

04 Mar '19

Recently we have noticed that our master server is borderline unusable. The webui will time out with the message 'Web UI got in unrecoverable state during "metadata" phase.' Running commands on the command line take minutes to run. While trouble shooting this I found these errors in the http error_log. DOMAIN.NET is our redacted name. [Fri Mar 01 00:28:10.054324 2019] [:error] [pid 70749] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 200, in read_input [Fri Mar 01 00:28:10.054326 2019] [:error] [pid 70749] return environ['wsgi.input'].read(length).decode('utf-8') [Fri Mar 01 00:28:10.054329 2019] [:error] [pid 70749] IOError: request data read error [Fri Mar 01 00:28:10.054474 2019] [:error] [pid 70749] ipa: INFO: [jsonserver_kerb] admin(a)DOMAIN.NET: None: InternalError [Fri Mar 01 00:28:10.070493 2019] [:error] [pid 70749] ipa: ERROR: non-public: IOError: request data read error [Fri Mar 01 00:28:10.070514 2019] [:error] [pid 70749] Traceback (most recent call last): [Fri Mar 01 00:28:10.070517 2019] [:error] [pid 70749] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 360, in wsgi_execute [Fri Mar 01 00:28:10.070520 2019] [:error] [pid 70749] data = read_input(environ) [Fri Mar 01 00:28:10.070528 2019] [:error] [pid 70749] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 200, in read_input [Fri Mar 01 00:28:10.070531 2019] [:error] [pid 70749] return environ['wsgi.input'].read(length).decode('utf-8') [Fri Mar 01 00:28:10.070533 2019] [:error] [pid 70749] IOError: request data read error [Fri Mar 01 00:28:10.070698 2019] [:error] [pid 70749] ipa: INFO: [xmlserver] admin(a)DOMAIN.NET: None: InternalError [Fri Mar 01 00:28:10.086787 2019] [:error] [pid 70749] ipa: ERROR: non-public: IOError: request data read error [Fri Mar 01 00:28:10.086809 2019] [:error] [pid 70749] Traceback (most recent call last): [Fri Mar 01 00:28:10.086812 2019] [:error] [pid 70749] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 360, in wsgi_execute [Fri Mar 01 00:28:10.086815 2019] [:error] [pid 70749] data = read_input(environ) [Fri Mar 01 00:28:10.086817 2019] [:error] [pid 70749] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 200, in read_input [Fri Mar 01 00:28:10.086820 2019] [:error] [pid 70749] return environ['wsgi.input'].read(length).decode('utf-8') [Fri Mar 01 00:28:10.086823 2019] [:error] [pid 70749] IOError: request data read error [Fri Mar 01 00:28:10.086968 2019] [:error] [pid 70749] ipa: INFO: [jsonserver_kerb] admin(a)DOMAIN.NET: None: InternalError [Fri Mar 01 00:28:10.103055 2019] [:error] [pid 70749] ipa: ERROR: non-public: IOError: request data read error [Fri Mar 01 00:28:10.103075 2019] [:error] [pid 70749] Traceback (most recent call last): [Fri Mar 01 00:28:10.103077 2019] [:error] [pid 70749] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 360, in wsgi_execute [Fri Mar 01 00:28:10.103080 2019] [:error] [pid 70749] data = read_input(environ) [Fri Mar 01 00:28:10.103083 2019] [:error] [pid 70749] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 200, in read_input [Fri Mar 01 00:28:10.103085 2019] [:error] [pid 70749] return environ['wsgi.input'].read(length).decode('utf-8') [Fri Mar 01 00:28:10.103088 2019] [:error] [pid 70749] IOError: request data read error [Fri Mar 01 00:28:10.103245 2019] [:error] [pid 70749] ipa: INFO: [xmlserver] admin(a)DOMAIN.NET: None: InternalError [Fri Mar 01 00:28:10.119618 2019] [:error] [pid 70749] ipa: INFO: [jsonserver_kerb] admin(a)DOMAIN.NET: ping(): SUCCESS [Fri Mar 01 00:28:10.138727 2019] [:error] [pid 70749] ipa: INFO: [jsonserver_session] admin(a)DOMAIN.NET: ping(): SUCCESS [Fri Mar 01 00:28:10.142020 2019] [:warn] [pid 70986] [client 172.31.59.230:50746] failed to set perms (3140) on file (/var/run/ipa/ccaches/admin(a)DOMAIN.NET) referer: https://ipa-1.domain.net/ipa/xml

2 3

Squid proxy digest authentication
by Edward Valley 04 Mar '19

04 Mar '19

3 3

IPAM that integrates well with FreeIPA
by TomK 04 Mar '19

04 Mar '19

Hey Guy's, I'm looking for an IPAM (IP Address Management) tool that will integrate with FreeIPA to provide: 1) IP Management 2) Provides DHCP 3) *Integrates well with FreeIPA* Many of the tools I saw provide conflicting capabilities. Would be great if the IPAM tool checked FreeIPA to see if the IP is already used. Has anyone come across such a tool and tried it with FreeIPA? -- Cheers, Tom K. ------------------------------------------------------------------------------------- Living on earth is expensive, but it includes a free trip around the sun.

3 2

client cannot authenticate or su
by Albert Szostkiewicz 03 Mar '19

03 Mar '19

Hi, I've installed ipa-client on my laptop without issues, it did found domain properly. kinit connects to ipa but I am unable to su any user or even login: (root)$ su my_user su: user my_user does not exist (root)$ cat /var/log/sssd/sssd_nss.log (Sun Mar 3 09:54:41 2019) [sssd[nss]] [nss_getby_id] (0x0400): Input ID: 0 (Sun Mar 3 09:54:41 2019) [sssd[nss]] [cache_req_set_plugin] (0x2000): CR #219: Setting "User by ID" plugin (Sun Mar 3 09:54:41 2019) [sssd[nss]] [cache_req_send] (0x0400): CR #219: New request 'User by ID' (Sun Mar 3 09:54:41 2019) [sssd[nss]] [cache_req_select_domains] (0x0400): CR #219: Performing a multi-domain search (Sun Mar 3 09:54:41 2019) [sssd[nss]] [cache_req_search_domains] (0x0400): CR #219: Search will check the cache and check the data provider (Sun Mar 3 09:54:41 2019) [sssd[nss]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/DOM_LOCATE_TYPE/implicit_files/User by ID] (Sun Mar 3 09:54:41 2019) [sssd[nss]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/DOM_LOCATE_TYPE/home.mydomain.com/User by ID] (Sun Mar 3 09:54:41 2019) [sssd[nss]] [cache_req_validate_domain_type] (0x2000): Request type POSIX-only for domain implicit_files type POSIX is valid (Sun Mar 3 09:54:41 2019) [sssd[nss]] [cache_req_set_domain] (0x0400): CR #219: Using domain [implicit_files] (Sun Mar 3 09:54:41 2019) [sssd[nss]] [cache_req_search_send] (0x0400): CR #219: Looking up UID:0@implicit_files (Sun Mar 3 09:54:41 2019) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #219: Checking negative cache for [UID:0@implicit_files] (Sun Mar 3 09:54:41 2019) [sssd[nss]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/UID/implicit_files/0] (Sun Mar 3 09:54:41 2019) [sssd[nss]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/UID/0] (Sun Mar 3 09:54:41 2019) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #219: [UID:0@implicit_files] does not exist (negative cache) (Sun Mar 3 09:54:41 2019) [sssd[nss]] [cache_req_validate_domain_type] (0x2000): Request type POSIX-only for domain home.mydomain.com type POSIX is valid (Sun Mar 3 09:54:41 2019) [sssd[nss]] [cache_req_set_domain] (0x0400): CR #219: Using domain [home.mydomain.com] (Sun Mar 3 09:54:41 2019) [sssd[nss]] [cache_req_search_send] (0x0400): CR #219: Looking up UID:0@home.mydomain.com (Sun Mar 3 09:54:41 2019) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #219: Checking negative cache for [UID:0@home.mydomain.com] (Sun Mar 3 09:54:41 2019) [sssd[nss]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/UID/home.mydomain.com/0] (Sun Mar 3 09:54:41 2019) [sssd[nss]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/UID/0] (Sun Mar 3 09:54:41 2019) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #219: [UID:0@home.mydomain.com] does not exist (negative cache) (Sun Mar 3 09:54:41 2019) [sssd[nss]] [cache_req_process_result] (0x0400): CR #219: Finished: Not found (Sun Mar 3 09:54:41 2019) [sssd[nss]] [client_recv] (0x0200): Client disconnected! (Sun Mar 3 09:54:41 2019) [sssd[nss]] [client_close_fn] (0x2000): Terminated client [0x5565caddc630][31] (Sun Mar 3 09:54:41 2019) [sssd[nss]] [client_recv] (0x0200): Client disconnected! (Sun Mar 3 09:54:41 2019) [sssd[nss]] [client_close_fn] (0x2000): Terminated client [0x5565cadddc60][30] (root)$ id $my_user uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 (root)$ kinit my_user Password for my_user(a)HOME.MYDOMAIN.COM: (root)$ ipa user-find my_user -------------- 1 user matched -------------- User login: my_user First name: MyUserName Last name: MyUserSurname Home directory: /home/my_user Login shell: /bin/sh Principal name: my_user(a)HOME.MYDOMAIN.COM Principal alias: my_user(a)HOME.MYDOMAIN.COM Email address: my_user(a)mydomain.com, my.user(a)gmail.com UID: 1907400004 GID: 1907400003 SSH public key fingerprint: SHA256:############################################# my_user(a)mydomain.com (ssh-rsa) Account disabled: False ---------------------------- Number of entries returned 1 ---------------------------- I've cleared /var/lib/sss/db/*

1 2

ipa service vault - cannot find
by Dmitry Perets 02 Mar '19

02 Mar '19

Hi, Sorry, I am probably missing something very basic in the way how the vault should work for services... So my task is simple: let's say I want to store a secret for a script. That is, the script must be able to retrieve it in an unattended way. The script is running on a Linux server server.mydomain.com, which is enrolled in FreeIPA domain. The script is running under user "svc-user" which I've created on the FreeIPA just for that (so, its principal is svc-user(a)MYDOMAIN.COM) Additionally, I've also created a service "MYSVC" on the FreeIPA (so I now also have the principal MYSVC\server.mydomain.com(a)MYDOMAIN.COM) Finally, I did not set any password for the user "svc-user" and I've configured its shell to be /sbin/nologin. Not sure if it will make any difference. And now, with all this ready, I am trying to store my secret as admin, so that my script can retrieve it. I create a vault (I tried also standard one, but here I am showing an example with asymmetrical one, because all examples I found use it): kinit admin <Entering password for admin> ipa vault-add svc-vault --service MYSVC\server.mydomain.com --type asymmetric --public-key-file svc.pub.pem ipa vault-archive svc-vault --service MYSVC\server.mydomain.com --data <secret_data_in_base64> OK, secret is stored. And here is my vault: # ipa vault-find --services --------------- 1 vault matched --------------- Vault name: svc-vault Type: asymmetric Vault service: MYSVC\server.mydomain.com(a)MYDOMAIN.COM ---------------------------- Number of entries returned 1 ---------------------------- Finally, I generate a keytab for my script: ipa-getkeytab -p MYSVC\server.mydomain.com -k /var/kerberos/krb5/user/856500016/client.keytab OK... now I clean up with "kdestroy" and try to run my script as a user "svc-user". And the script is trying to do this: kinit MYSVC\server.mydomain.com -k -t /var/kerberos/krb5/user/856500016/client.keytab klist ipa vault-find --services ... And the problem is that it simply doesn't find the svc-vault. It does seem like it manages to get the Kerberos ticket, this is the output from klist (inside the script): Default principal: MYSVC\server.mydomain.com(a)MYDOMAIN.COM Valid starting Expires Service principal 02/27/2019 17:04:58 02/28/2019 17:04:58 krbtgt/MYDOMAIN.COM(a)MYDOMAIN.COM Now... If I add the user "svc-user" as a member to my svc-vault, add the svc-user to the keytab and then use "kinit svc-user" in my script, then it seems to work. But I don't understand then the whole point of "service vault"... what's the purpose of the MYSVC/server.mydomain.com principle here actually...? And another question - can't exactly the same (with "svc-user" in keytab) work also for a standard vault, without keys...? Because it looks like it becomes exactly the same usecase as if I just interactively use the vault shared with svc-user... Thanks!

1 2

Set up ipa-client via Ansible
by Ronald Wimmer 01 Mar '19

01 Mar '19

Hi, I set up relevant ansible files exaclty like described in: https://www.freeipa.org/page/V4/ClientInstallationWithAnsible#Ansible_ipacl… The ipaclient role was fetched from here: https://github.com/freeipa/ansible-freeipa/tree/master/roles Uninstalling an ipaclient works. Installing an ipaclient fails with: > ERROR! no action detected in task. This often indicates a misspelled > module name, or incorrect module path. > > The error appears to have been in '/srv/ansible/install.yml': line 12, > column 5, but may > be elsewhere in the file depending on the exact syntax problem. > > The offending line appears to be: > > > - name: Configure IPA client > ^ here Most likely the ipaclient module cannot be found. I downloaded https://github.com/freeipa/ansible-freeipa/tree/master/module_utils and put the three python files into the library directory next to my install.yml playbook file. I also put them into ~/.ansible/plugins/modules. But that still did not work. This is my install.yml: > --- > - name: Playbook to configure IPA clients with username/password > hosts: ipaclients > become: true > > tasks: > - name: Install IPA client package > package: > name: ipa-client > state: present > > - name: Configure IPA client > ipaclient: > state: present > domain: "{{ ipaclient_domain }}" > realm: "{{ ipaclient_realm }}" > principal: "{{ ipaclient_principal }}" > password: "{{ ipaclient_password }}" > extra_args: "{{ ipaclient_extraargs }}" And this my inventory file: > [ipaclients] > ipa-test.linux.mydomain.at > > [ipaclients:vars] > ipaclient_domain=linux.mydomain.at > ipaclient_realm=LINUX.MYDOMAIN.AT > #ipaclient_extraargs=[ '--kinit-attempts=3', '--mkhomedir'] > ipaclient_principal=enroll > ipaclient_password=somepass What am I missing here? Cheers, Ronald

2 2

Autofs maps for students directories divided by first letter of username
by Kristian Petersen 28 Feb '19

28 Feb '19

Is there a way to set up the maps to mount a users home directory if they are divided up under a directory that is the first letter of their username without mounting all such directories for every user? We have thousands of students needing home directories and so they have divided up this way. Example: /home/students/a/aardvark or /home/students/b/bugsbunny. The docs I have read on autofs maps haven't been very clear on how to define this kind of mapping, especially in FreeIPA. -- Kristian Petersen System Administrator BYU Dept. of Chemistry and Biochemistry

4 4

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2019