March 2020 - FreeIPA-users - Fedora Mailing-Lists

by White, David

I'm reviewing the documentation at https://www.freeipa.org/page/V4/Allow_AD_users_to_manage_FreeIPA, as I am hoping to allow members of certain AD groups to login to FreeIPA from the web GUI. Does this documentation only apply to the FreeIPA CLI, or does it also affect access to manage through the web GUI? Let's say we have an AD group named "engineers", and I want those engineers to have admin access over FreeIPA. If the above documentation only affects the CLI, that feels a little bit redundant, because we can of course easily create Sudo / Su rules to allow members of "engineers" to have control over the FreeIPA nodes using HBAC rules and such. (This is already done and working -- members of `engineers` already have CLI admin access over FreeIPA -- I now want them to have GUI admin access). I'm also a little bit confused why the documentation says to add a domain user to the AD "administrators" group (as an ID Override). That feels like a security risk, because I don't want the user to be considered an Active Directory administrator -- I only want the person (well, any members of the `engineers` group) to have admin access over FreeIPA. It sounds like this would have to be done on a user-by-user basis (and is not something we could apply to an entire AD group that already exists)? I ran: `id administrator(a)ad.domain.com` and verified that I do have stdout. But then I ran: `ipa group-show administrator(a)ad.domain.com` and stdout included: ipa: ERROR: administrator(a)ad.domain.com: group not found Is there any way to accomplish what I want? ----- David White Engineer II, Fiber Systems Engineering

2 years, 4 months

3
8
0 / 0

Replaced IPA server - now cannot ssh to it from ipa clients

by Russ Long

In my homelab, where I only have a single IPA server, I have had to rebuild / replace it due to issues outside of IPA. I was unable to restore the VM from a snapshot, however I was able to rebuild and use a backup created by ipa-backup to perform a restore. Everything appeared to work fine, and IPA clients are working, as well as LDAP and other services. The only issue I'm encountering is that when I try to ssh to the IPA server from one of the clients, SSH hangs here: $ ssh -vvvvv master OpenSSH_8.1p1, OpenSSL 1.1.1d FIPS 10 Sep 2019 debug1: Reading configuration data /etc/ssh/ssh_config debug3: /etc/ssh/ssh_config line 51: Including file /etc/ssh/ssh_config.d/05-redhat.conf depth 0 debug1: Reading configuration data /etc/ssh/ssh_config.d/05-redhat.conf debug2: checking match for 'final all' host master originally master debug3: /etc/ssh/ssh_config.d/05-redhat.conf line 3: not matched 'final' debug2: match not found debug3: /etc/ssh/ssh_config.d/05-redhat.conf line 5: Including file /etc/crypto-policies/back-ends/openssh.config depth 1 (parse only) debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config debug3: gss kex names ok: [gss-gex-sha1-,gss-group14-sha1-,gss-group1-sha1-] debug3: kex names ok: [curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1] debug1: configuration requests final Match pass debug1: re-parsing configuration debug1: Reading configuration data /etc/ssh/ssh_config debug3: /etc/ssh/ssh_config line 51: Including file /etc/ssh/ssh_config.d/05-redhat.conf depth 0 debug1: Reading configuration data /etc/ssh/ssh_config.d/05-redhat.conf debug2: checking match for 'final all' host master originally master debug3: /etc/ssh/ssh_config.d/05-redhat.conf line 3: matched 'final' debug2: match found debug3: /etc/ssh/ssh_config.d/05-redhat.conf line 5: Including file /etc/crypto-policies/back-ends/openssh.config depth 1 debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config debug3: gss kex names ok: [gss-gex-sha1-,gss-group14-sha1-,gss-group1-sha1-] debug3: kex names ok: [curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1] debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 22 master debug1: identity file /home/rlong/.ssh/id_rsa type -1 debug1: identity file /home/rlong/.ssh/id_rsa-cert type -1 debug1: identity file /home/rlong/.ssh/id_dsa type -1 debug1: identity file /home/rlong/.ssh/id_dsa-cert type -1 debug1: identity file /home/rlong/.ssh/id_ecdsa type -1 debug1: identity file /home/rlong/.ssh/id_ecdsa-cert type -1 debug1: identity file /home/rlong/.ssh/id_ed25519 type -1 debug1: identity file /home/rlong/.ssh/id_ed25519-cert type -1 debug1: identity file /home/rlong/.ssh/id_xmss type -1 debug1: identity file /home/rlong/.ssh/id_xmss-cert type -1 debug1: Local version string SSH-2.0-OpenSSH_8.1 I'm assuming it has something to do with the knownhostsproxy setup, but I can't find any information on how to confirm that or what to do to resolve it. I am able to ssh to the IPA server from any system that is not enrolled as an IPA client. Any ideas?

2 years, 4 months

2
5
0 / 0

Create accounts for integration

by dmitriys

Hi! I need create accounts for integrations with different system. I don`t wont use standart accounts. So i tried create system user as discribe here Use a system account, created like this:. # ldapmodify -x -D 'cn=Directory Manager' -W after this command i get Enter LDAP Password: (witch password i need put here ?) ldap_bind: Invalid credentials (49) Where i can find right cn ?

2 years, 4 months

2
1
0 / 0

FreeIPA 4.7.5 released, last release in 4.7 series

by Alexander Bokovoy

2 years, 4 months

2
1
0 / 0

How Set authentication for ldapsearch

by dmitriys

Hi! When i use command ldapsearch -h ldap.exemple.com -p 389 -x -b dc=exemple,dc=com -L I get all information about my instance without any authentication How i can set authentication to this action ? When i change port ldapsearch -h ldap.exemple.com -p 636 -x -b dc=exemple,dc=com -L I didnt get any response why is that so ? Thank you!

2 years, 4 months

3
2
2 / 0

Issue with replication freeipa

by dmitriys

Hi! I try to setup replication. Freeipa version - 4.8.0, API_VERSION: 2.233 I have installed free ipa server and tried connect replica as describe in https://www.freeipa.org/page/V4/Replica_Setup Aftet this command ipa-client-install --domain=example.test --realm=EXAMPLE.TEST --server=ipa-server.example.test i get an error (full log) : [root@ldap-replica1 ~]# cat /var/log/ipaclient-install.log 2020-03-26T14:15:39Z DEBUG Logging to /var/log/ipaclient-install.log 2020-03-26T14:15:39Z DEBUG ipa-client-install was invoked with arguments [] and options: {'unattended': False, 'principal': None, 'prompt_password': False, 'on_master': False, 'ca_cert_files': None, 'force': False, 'configure_firefox': False, 'firefox_dir': None, 'keytab': None, 'mkhomedir': False, 'force_join': False, 'ntp_servers': None, 'ntp_pool': None, 'no_ntp': False, 'force_ntpd': False, 'nisdomain': None, 'no_nisdomain': False, 'ssh_trust_dns': False, 'no_ssh': False, 'no_sshd': False, 'no_sudo': False, 'no_dns_sshfp': False, 'kinit_attempts': None, 'request_cert': False, 'ip_addresses': None, 'all_ip_addresses': False, 'fixed_primary': False, 'permit': False, 'enable_dns_updates': False, 'no_krb5_offline_passwords': False, 'preserve_sssd': False, 'automount_location': None, 'domain_name': 'araxio.tech', 'servers': ['ldap.araxio.tech'], 'realm_name': 'ARAXIO.TECH', 'host_name': None, 'verbose': False, 'quiet': False, 'log_file': None, 'uninstall': False} 2020-03-26T14:15:39Z DEBUG IPA version 4.8.0-13.module_el8.1.0+265+e1e65be4 2020-03-26T14:15:39Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' 2020-03-26T14:15:39Z DEBUG Starting external process 2020-03-26T14:15:39Z DEBUG args=['/usr/sbin/selinuxenabled'] 2020-03-26T14:15:39Z DEBUG Process finished, return code=0 2020-03-26T14:15:39Z DEBUG stdout= 2020-03-26T14:15:39Z DEBUG stderr= 2020-03-26T14:15:39Z DEBUG Starting external process 2020-03-26T14:15:39Z DEBUG args=['/bin/systemctl', 'is-enabled', 'ntpd.service'] 2020-03-26T14:15:39Z DEBUG Process finished, return code=1 2020-03-26T14:15:39Z DEBUG stdout= 2020-03-26T14:15:39Z DEBUG stderr=Failed to get unit file state for ntpd.service: No such file or directory 2020-03-26T14:15:39Z DEBUG Starting external process 2020-03-26T14:15:39Z DEBUG args=['/bin/systemctl', 'is-active', 'ntpd.service'] 2020-03-26T14:15:39Z DEBUG Process finished, return code=3 2020-03-26T14:15:39Z DEBUG stdout=inactive 2020-03-26T14:15:39Z DEBUG stderr= 2020-03-26T14:15:39Z DEBUG Deleting invalid keytab: '/etc/krb5.keytab'. 2020-03-26T14:15:39Z DEBUG [IPA Discovery] 2020-03-26T14:15:39Z DEBUG Starting IPA discovery with domain=araxio.tech, servers=['ldap.araxio.tech'], hostname=ldap-replica1.araxio.tech 2020-03-26T14:15:39Z DEBUG Server and domain forced 2020-03-26T14:15:39Z DEBUG [Kerberos realm search] 2020-03-26T14:15:39Z DEBUG Kerberos realm forced 2020-03-26T14:15:39Z DEBUG [LDAP server check] 2020-03-26T14:15:39Z DEBUG Verifying that ldap.araxio.tech (realm ARAXIO.TECH) is an IPA server 2020-03-26T14:15:39Z DEBUG Init LDAP connection to: ldap://ldap.araxio.tech:389 2020-03-26T14:15:40Z DEBUG Search LDAP server for IPA base DN 2020-03-26T14:15:40Z DEBUG Check if naming context 'dc=araxio,dc=tech' is for IPA 2020-03-26T14:15:40Z DEBUG Naming context 'dc=araxio,dc=tech' is a valid IPA context 2020-03-26T14:15:40Z DEBUG Search for (objectClass=krbRealmContainer) in dc=araxio,dc=tech (sub) 2020-03-26T14:15:40Z DEBUG Found: cn=ARAXIO.TECH,cn=kerberos,dc=araxio,dc=tech 2020-03-26T14:15:40Z DEBUG Discovery result: Success; server=ldap.araxio.tech, domain=araxio.tech, kdc=ldap.araxio.tech, basedn=dc=araxio,dc=tech 2020-03-26T14:15:40Z DEBUG Validated servers: ldap.araxio.tech 2020-03-26T14:15:40Z DEBUG will use discovered domain: araxio.tech 2020-03-26T14:15:40Z DEBUG Using servers from command line, disabling DNS discovery 2020-03-26T14:15:40Z DEBUG will use provided server: ldap.araxio.tech 2020-03-26T14:15:40Z INFO Autodiscovery of servers for failover cannot work with this configuration. 2020-03-26T14:15:40Z INFO If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure. 2020-03-26T14:15:41Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 179, in execute return_value = self.run() File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 340, in run return cfgr.run() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 358, in run self.validate() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 368, in validate for _nothing in self._validator(): File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 455, in _handle_validate_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 633, in _configure next(validator) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 455, in _handle_validate_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.6/site-packages/ipaclient/install/client.py", line 3772, in main install_check(self) File "/usr/lib/python3.6/site-packages/ipaclient/install/client.py", line 2311, in install_check raise ScriptError(rval=CLIENT_INSTALL_ERROR) 2020-03-26T14:15:41Z DEBUG The ipa-client-install command failed, exception: ScriptError: 2020-03-26T14:15:41Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information How i can fix it ?

2 years, 4 months

2
1
0 / 0

Issue with Using 3rd part certificates for HTTP/LDAP

by dmitriys

Hi! I use freeipa-server 4.7.0~pre1+git20180411-2ubuntu2 on Ubuntu 18.04.4 LTS I installed freeipa-serve in default mode ( ipa-server-install ) Now i try change certificate on Comodo as write in this article https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP my steps: 1 ipa-cacert-manage -p 'password' -n COMODO -t C,, install addtrustexternalcaroot2.crt Installing CA certificate, please wait CA certificate successfully installed The ipa-cacert-manage command was successful 2 ipa-server-certinstall -w -d /home/xattab/ldap_comodo.key ldap_comodo.pem -vvv get error ipapython.ipautil: DEBUG: stderr= ipapython.ipautil: DEBUG: Starting external process ipapython.ipautil: DEBUG: args=['/usr/bin/certutil', '-d', 'dbm:/tmp/tmpPsRUhs', '-V', '-n', 'CN=ldap.soft2bet.com', '-u', 'V', '-f', '/tmp/tmpPsRUhs/pwdfile.txt'] ipapython.ipautil: DEBUG: Process finished, return code=255 ipapython.ipautil: DEBUG: stdout=certutil: certificate is invalid: Peer's Certificate issuer is not recognized. ipapython.ipautil: DEBUG: stderr= ipapython.admintool: DEBUG: File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line 174, in execute return_value = self.run() File "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py", line 113, in run self.install_dirsrv_cert() File "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py", line 139, in install_dirsrv_cert 'restart_dirsrv %s' % serverid) File "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py", line 291, in import_cert self.check_chain(pkcs12_file.name, pin, cdb) File "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py", line 277, in check_chain "to install the CA certificate." % str(e)) ipapython.admintool: DEBUG: The ipa-server-certinstall command failed, exception: ScriptError: Peer's certificate issuer is not trusted (certutil: certificate is invalid: Peer's Certificate issuer is not recognized. ). Please run ipa-cacert-manage install and ipa-certupdate to install the CA certificate. ipapython.admintool: ERROR: Peer's certificate issuer is not trusted (certutil: certificate is invalid: Peer's Certificate issuer is not recognized. ). Please run ipa-cacert-manage install and ipa-certupdate to install the CA certificate. ipapython.admintool: ERROR: The ipa-server-certinstall command failed. How to fix it ? Can anybody help me ))) ?

2 years, 4 months

4
10
7 / 0

Freeipa unicodepwd generator

by LUCAS GUILHERME DIEDRICH

Hello guys, is there any change for storing the password over freeipa it generate an password with the unicodepwd format? I'm still trying to replicate some users from freeipa to AD, i would like to mantain my Freeipa as the principal manager for users and groups. thanks.

2 years, 4 months

5
9
0 / 0

AD trust external group in the foreman

by Natxo Asenjo

hi, the foreman can not authenticate using external authentication using the api endpoints, apparently, which is a bit of a bummer. It can do ldap, though, so the question is: can I authenticate AD users using the compat tree in Idm? (rhel 7.7 by the way). -- -- Groeten, natxo

2 years, 4 months

2
2
0 / 0

Script deletion of a host?

by aaronhcarr＠gmail.com

This may be a bit of a strange scenario. Environment is a compute cluster (running xCAT 2.15) FreeIPA server is running on the cluster master node. FreeIPA clients are installed on all other nodes. Compute nodes, login nodes, storage nodes, GPU nodes, etc. I created a script that installs the client packages and joins the realm after provisioning the OS. That all works great on new hosts. My issue is that compute nodes are reinstalled on occasion. Normally, that is a simple process. Tell the cluster master to mark that host for install. During the next PXE boot, that happens. Problem is, if the node has already been part of the realm, it can't join, so that command fails. If I manually go into FreeIPA server and remove the node while it's reinstalling the OS, then the client script runs fine when that is complete. Is there a way to have a client execute a command to remove it's previous information before joining? Thanks in advance.

2 years, 4 months

2
2
0 / 0

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2020