February 2020 - FreeIPA-users - Fedora mailing-lists

ipa-replica-install failing
by Mitchell Smith 25 Aug '20

25 Aug '20

Hi list, I wanted to repost this issue with a more appropriate subject line, in case anyone has come across this issue before and has a work around. To provide some context, I have two FreeIPA instances running FreeIPA 4.3.1 on Ubuntu 16.04 LTS. I want to migrate to FreeIPA 4.5.4 running on CentOS 7. I have a way to migrate by dumping all the users out with ldapsearch and adding them to the new instance with ldapadd but it is a bit messy and will result in all users having to reset their password, as it won't let me add in already encrypted passwords. My initial thought was to add the new instance as a replica and then eventually retire the old one. I ran in to some problems with the ‘ipa-replica-install’ command though. I was able to join as a client no problem, but when I went to run ‘ipa-replica-install’ it failed while configuring the directory server component. [25/42]: restarting directory server [26/42]: creating DS keytab [27/42]: ignore time skew for initial replication [28/42]: setting up initial replication [error] DatabaseError: Server is unwilling to perform: modification of attribute nsds5replicareleasetimeout is not allowed in replica entry Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. I thought this might have something to do with differences between 4.3.1 and 4.5.4 but I wasn’t entirely sure. If there is a work around for this issue, it would be a significantly easier transition to the new FreeIPA instance. Cheers, Mitch

3 4

IPA healthcheck for older versions
by Rob Crittenden 24 Aug '20

24 Aug '20

Over the summer we announced the freeipa-healthcheck project which is designed to look at an IdM cluster and look for common problems so you can have some level of assurance that the system is running as it should. It was built against the IPA 4.8.x branch and originally released only for Fedora 29+. It is also included in the newly released RHEL 8.1.0. My curious nature led me to see if it would also work in in the IPA 4.6.x branch. It was a bit of a challenge backing down to Python 2 but I was able to get something working. I tested primarily on Fedora 27 but it should also work in RHEL/CentOS 7 (I smoke tested 7.8). I made an EPEL 7 build in COPR, https://copr.fedorainfracloud.org/coprs/rcritten/ipa-healthcheck/ Enable the repo and do: yum install freeipa-healthcheck Then run: ipa-healthcheck --failures-only Ideally there will be no output but an empty list []. Otherwise the output is JSON and hopefully has enough information to point you in the right direction. Feel free to ask if need help. False positives are always a possibility and many of the checks run independently so it's possible to get multiple issues from a single root problem. It's hard to predict all possible installations so some fine-tuning may be required. I'd recommend running it every now and then at least, like prior to updating IPA packages, creating a new master, etc, if not daily. It will, for example, warn of impending cert expiration. The more feedback I get on it the better and more useful I can make it. This is my own personal backport and is not officially supported by anyone but me. It's preferred to report issues on this mailing list. I'll see them and others may be able to chime in as well. rob

10 32

kinit -n asking for password on clients
by John Ratliff 13 Jul '20

13 Jul '20

When trying to do pkinit, if I do kinit -n on one of the IdM servers, it works fine. If I try on a client machine, it asks me for the password for WELLKNOWN/ANONYMOUS@REALM. I have the pkinit_anchors setup for the realm. As I'm trying to do anonymous pkinit, I think I don't need a client certificate. On the server, I get this: $ KRB5_TRACE="/dev/stderr" kinit -n [13061] 1518402857.924212: Getting initial credentials for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM [13061] 1518402857.929673: Sending request (200 bytes) to IDM.EXAMPLE.COM [13061] 1518402857.931830: Initiating TCP connection to stream 10.77.9.101:88 [13061] 1518402857.932241: Sending TCP request to stream 10.77.9.101:88 [13061] 1518402857.939162: Received answer (359 bytes) from stream 10.77.9.101:88 [13061] 1518402857.939180: Terminating TCP connection to stream 10.77.9.101:88 [13061] 1518402857.939284: Response was from master KDC [13061] 1518402857.939380: Received error from KDC: -1765328359/Additional pre-authentication required [13061] 1518402857.939474: Processing preauth types: 16, 15, 14, 136, 19, 147, 2, 133 [13061] 1518402857.939499: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [13061] 1518402857.939509: Received cookie: MIT [13061] 1518402857.939563: Preauth module pkinit (147) (info) returned: 0/Success [13061] 1518402857.940352: PKINIT client computed kdc-req-body checksum 9/D98A0144E7E4ACC66B63EBCA98379AB9F055D143 [13061] 1518402857.940369: PKINIT client making DH request [13061] 1518402858.935: Preauth module pkinit (16) (real) returned: 0/Success [13061] 1518402858.956: Produced preauth for next request: 133, 16 [13061] 1518402858.994: Sending request (1408 bytes) to IDM.EXAMPLE.COM [13061] 1518402858.1091: Initiating TCP connection to stream 10.77.9.101:88 [13061] 1518402858.1187: Sending TCP request to stream 10.77.9.101:88 [13061] 1518402858.43063: Received answer (2880 bytes) from stream 10.77.9.101:88 [13061] 1518402858.43088: Terminating TCP connection to stream 10.77.9.101:88 [13061] 1518402858.43198: Response was from master KDC [13061] 1518402858.43258: Processing preauth types: 17, 19, 147 [13061] 1518402858.43273: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [13061] 1518402858.43300: Preauth module pkinit (147) (info) returned: 0/Success [13061] 1518402858.44150: PKINIT client verified DH reply [13061] 1518402858.44189: PKINIT client found id-pkinit-san in KDC cert: krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM [13061] 1518402858.44199: PKINIT client matched KDC principal krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM against id-pkinit-san; no EKU check required [13061] 1518402858.62345: PKINIT client used KDF 2B06010502030602 to compute reply key aes256-cts/00E0 [13061] 1518402858.62395: Preauth module pkinit (17) (real) returned: 0/Success [13061] 1518402858.62402: Produced preauth for next request: (empty) [13061] 1518402858.62414: AS key determined by preauth: aes256-cts/00E0 [13061] 1518402858.62547: Decrypted AS reply; session key is: aes256-cts/96F0 [13061] 1518402858.62589: FAST negotiation: available [13061] 1518402858.62692: Initializing KEYRING:persistent:760400007:krb_ccache_f3PFEy1 with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS [13061] 1518402858.62770: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 [13061] 1518402858.62846: Storing config in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 for krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM: fast_avail: yes [13061] 1518402858.62878: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/IDM.EXAMPLE.COM\@IDM.EXAMPLE.COM@X-CACHECONF: in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 [13061] 1518402858.62933: Storing config in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 for krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM: pa_type: 16 [13061] 1518402858.62954: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/IDM.EXAMPLE.COM\@IDM.EXAMPLE.COM@X-CACHECONF: in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 But on the client, I get this: $ KRB5_TRACE="/dev/stderr" kinit -n [2941] 1518402820.155827: Getting initial credentials for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM [2941] 1518402820.156298: Sending request (200 bytes) to IDM.EXAMPLE.COM [2941] 1518402820.158723: Resolving hostname paine.example.com. [2941] 1518402820.159975: Resolving hostname phantom.example.com. [2941] 1518402820.160757: Resolving hostname paine.example.com. [2941] 1518402820.161411: Initiating TCP connection to stream 204.89.253.101:88 [2941] 1518402820.162065: Sending TCP request to stream 204.89.253.101:88 [2941] 1518402820.168495: Received answer (359 bytes) from stream 204.89.253.101:88 [2941] 1518402820.168532: Terminating TCP connection to stream 204.89.253.101:88 [2941] 1518402820.169917: Response was from master KDC [2941] 1518402820.169974: Received error from KDC: -1765328359/Additional pre-authentication required [2941] 1518402820.170029: Processing preauth types: 16, 15, 14, 136, 19, 147, 2, 133 [2941] 1518402820.170051: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [2941] 1518402820.170062: Received cookie: MIT Password for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM: [2941] 1518402833.34612: Preauth module encrypted_timestamp (2) (real) returned: -1765328252/Password read interrupted kinit: Pre-authentication failed: Password read interrupted while getting initial credentials Suggestions on what I'm missing? Thanks.

3 3

automember hostgroup by account?
by Amos 14 Jun '20

14 Jun '20

Is it possible to have an automember rule to add a host to a hostgroup based on the account used with ipa-install-client? Amos

3 6

IPA and legacy systems
by Ronald Wimmer 27 May '20

27 May '20

What would be a good solution to add systems where the FQDN cannot be changed? Would it make sense to add a second DNS A Record in the IPA domain for each of these systems? Is there any experience on how to deal with such a situation? Thanks a lot in advance! Cheers, Ronald

5 17

Samba integration - access without Kerberos
by lejeczek 29 Apr '20

29 Apr '20

hi everybody. I see this subject might have been poked around many times, a couple times at least for sure. But, I thought I'll poke again and hopefully get some latest comments & thoughts on - how to make IPA's Samba allow password authentication to Win clients from outside of IPA/AD domains? Would there, by now, possibly be a semi-official (by IPA team) way of getting there, since the subject first came up a longer while ago? many thanks, L.

2 6

ipa-adtrust-install --unattended | did not quite work?
by lejeczek 28 Apr '20

28 Apr '20

hi everyone, I did something pretty vanilla: $ ipa-adtrust-install --unattended --admin-password=xxx Process showed first some warning about "unattended" but then this: Configuring CIFS [1/24]: validate server hostname [2/24]: stopping smbd [3/24]: creating samba domain object [4/24]: retrieve local idmap range [5/24]: creating samba config registry [6/24]: writing samba config file [7/24]: adding cifs Kerberos principal [8/24]: adding cifs and host Kerberos principals to the adtrust agents group [9/24]: check for cifs services defined on other replicas [10/24]: adding cifs principal to S4U2Proxy targets [11/24]: adding admin(group) SIDs [12/24]: adding RID bases [13/24]: updating Kerberos config 'dns_lookup_kdc' already set to 'true', nothing to do. [14/24]: activating CLDAP plugin [15/24]: activating sidgen task [16/24]: map BUILTIN\Guests to nobody group [17/24]: configuring smbd to start on boot [18/24]: adding special DNS service records [19/24]: restarting Directory Server to take MS PAC and LDAP plugins changes into account [20/24]: adding fallback group [21/24]: adding Default Trust View [22/24]: setting SELinux booleans [23/24]: starting CIFS services ipaserver.install.adtrustinstance: CRITICAL CIFS services failed to start [24/24]: restarting smbd Done configuring CIFS. Now, Samba would not start and I wonder what that might have to do with the above: tarting Samba SMB Daemon... [2020/02/14 11:21:34.801358, 0] ../../source3/passdb/pdb_interface.c:171(make_pdb_method_name) No builtin nor plugin backend for ipasam found smb.service: Main process exited, code=exited, status=1/FAILURE smb.service: Failed with result 'exit-code'. Failed to start Samba SMB Daemon. Or is is it unrelated? Hot to troubleshoot & fix it? I'm on Centos 8 with ipa-server-4.8.0-13.module_el8.1.0+265+e1e65be4.x86_64 many thanks, L.

2 4

ipa: ERROR: CIFS server communication error: code "3221225506", message "{Access Denied} A process has requested access to an object but has not been granted those access rights." (both may be "None")
by Bernard Lheureux 20 Apr '20

20 Apr '20

Hi all, After a fresh install of FreeIPA 4.6.5-11.el7.centos.x86_64, fully updated from update repo on a CentOS7 x64 server, it appears that it is totally impossible to establish a trust with an AD running on local AD servers, we did it a few times ago with exactly the same distribution and had really no problem, we tried to completely reinstall the machine and the IPA wit always the same results, ipa: ERROR: CIFS server communication error: code "3221225506", message "{Access Denied} A process has requested access to an object but has not been granted those access rights." (both may be "None") Could someone point me to the direction to look for, because we are going nuts on this ? We found some tips in the /var/log/httpd/errors, but nothing seems to provide sufficient infos... [Wed Oct 02 12:54:57.868830 2019] [:error] [pid 2036] ipa: INFO: [jsonserver_session] admin(a)DOMAIN.INTRA: trust_add/1(u'domain.intra', trust_type=u'ad', realm_admin=u'admin', realm_passwd=u'********', bidirectional=True, version=u'2.231'): RemoteRetrieveError The IPA server and the AD servers are in the same VLan with no firewall between them samba version on the IPA server is the latest available: 4.9.1-6.el7.noarch Thanks for your help...

3 7

Domain controllers switch to LDAPS
by Ronald Wimmer 08 Apr '20

08 Apr '20

Hi, will Microsofts decision to let domain controllers talk LDAPS only in the near future affect IPA sowehow? Cheers, Ronald

3 9

Allow AD users to manage FreeIPA
by White, David 27 Mar '20

27 Mar '20

I'm reviewing the documentation at https://www.freeipa.org/page/V4/Allow_AD_users_to_manage_FreeIPA, as I am hoping to allow members of certain AD groups to login to FreeIPA from the web GUI. Does this documentation only apply to the FreeIPA CLI, or does it also affect access to manage through the web GUI? Let's say we have an AD group named "engineers", and I want those engineers to have admin access over FreeIPA. If the above documentation only affects the CLI, that feels a little bit redundant, because we can of course easily create Sudo / Su rules to allow members of "engineers" to have control over the FreeIPA nodes using HBAC rules and such. (This is already done and working -- members of `engineers` already have CLI admin access over FreeIPA -- I now want them to have GUI admin access). I'm also a little bit confused why the documentation says to add a domain user to the AD "administrators" group (as an ID Override). That feels like a security risk, because I don't want the user to be considered an Active Directory administrator -- I only want the person (well, any members of the `engineers` group) to have admin access over FreeIPA. It sounds like this would have to be done on a user-by-user basis (and is not something we could apply to an entire AD group that already exists)? I ran: `id administrator(a)ad.domain.com` and verified that I do have stdout. But then I ran: `ipa group-show administrator(a)ad.domain.com` and stdout included: ipa: ERROR: administrator(a)ad.domain.com: group not found Is there any way to accomplish what I want? ----- David White Engineer II, Fiber Systems Engineering

3 8

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2020