May 2020 - FreeIPA-users - Fedora mailing-lists

HTTP service in a host with multiple cnames and kerberos authentication
by Peter Tselios 14 May '20

14 May '20

I have a few hosts with multiple cnames serving different websites. I need to have Authentication from Kerberos and LDAP authz. This works just fine when I have one service per host. But, when I add multple services on the host, it's not working. What I have is this: I create a service in IdM: HTTP/server.example.com I add the CNAMES as aliases on the keytab. So, my Principal alias has 3-4 entries: 1. HTTP/server.example.com 2. HTTP/cname1.example.com 3. HTTP/cname2.example.com 4. HTTP/cname3.example.com Then I download the keytab on the server and I have the following apache configuration: <VirtualHost *:443> ServerName cnameX.example.com ServerAlias cnameX.example.com <Location /> AuthType Kerberos AuthName "Login via IdM" KrbMethodNegotiate on KrbServiceName HTTP/cnameX.example.com Krb5Keytab /etc/httpd/http_hostname.keytab KrbSaveCredentials on AuthLDAPUrl "ldaps://ipamaster.example.com ipa.example.com/dc=example,dc=com?krbPrincipalName" AuthLDAPBindDN "uid=appusers,cn=sysaccounts,cn=etc,dc=example,dc=com" AuthLDAPBindPassword "secret" require ldap-group cn=mygroup,cn=groups,cn=accounts,dc=example,dc=com </Location> </VirtualHost> But when I try to login I get this error: failed to verify krb5 credentials: Decrypt integrity check failed So, how do I enable kerberos authentication for each virtual host? What do I do wrong here?

1 2

Questions about IDM Smartcard Login
by David Woods 14 May '20

14 May '20

I'm trying to setup smart card login into an AD user account using an ID Override on RHEL 7.8. I have been looking through Red Hat's documentation and its a bit confusing. I was wondering what is the proper way to export a certificate from my CAC PIV card ? I have been just exporting the certificate in PEM format from the ESC tool and importing it into IDM web GUI. But SSSD isn't able to associate the smart card with the AD user. When I run the ipa certmap-match command, it will match to the AD account that I configured with the ID Override. I was also wondering if I need pam_pkcs11 and pam_krb5 installed anymore ? When I uninstall pam_pkcs11, GDM doesn't prompt me for my smart card PIN. I was looking at the "config-client-for-smart-card-auth" script and it removes the pam_pkcs11 RPM, that's why I am asking.

4 5

Plugin problem after upgrade
by Frederic AYRAULT 13 May '20

13 May '20

Bonjour, I upgraded my Centos servers from 7.7.1908 to 7.8.2003 and ipa upgrades from 4.6.5 to 4.6.6 In the directory /usr/share/ipa/ui/js/plugins/bureau , I am using the enclosed file bureau.js to show the room number field in the gui. But after the upgrade, the field is there, but empty. I deleted one of my servers, downgrade ipa packages et reinstall ipa, and the plugin is working, I can see the value in the field. Do you have any idea ? Thank you Regards, Frederic Frédéric AYRAULT Administrateur Systèmes et Réseaux Laboratoire d'Informatique de l'Ecole polytechnique <http://www.lix.polytechnique.fr> fred(a)lix.polytechnique.fr

1 3

Cannot find KDC for realm (dns on another machine)
by Tony Brian Albers 13 May '20

13 May '20

Hi guys, So, I'm trying to make this work: FreeIPA server has hostname: ipa001.pri.some.network FreeIPA client has hostname: cli001.pri.some.network The KRB Realm entered during the FreeIPA server setup is: SOME.NETWORK Now, when I try to add the client, it looks happy and is able to look up the server using DNS, but then it stops with: --- The ipa-client-install command failed, exception: KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639066): Cannot find KDC for realm "SOME.NETWORK" The ipa-client-install command failed. See /var/log/ipaclient- install.log for more information --- I've added the output from the ipa-server-install to the relevant dns zone: --- ; FreeIPA records START _kerberos-master._tcp.some.network. 86400 IN SRV 0 100 88 ipa001.pri.some.network. _kerberos-master._udp.some.network. 86400 IN SRV 0 100 88 ipa001.pri.some.network. _kerberos._tcp.some.network. 86400 IN SRV 0 100 88 ipa001.pri.some.network. _kerberos._udp.some.network. 86400 IN SRV 0 100 88 ipa001.pri.some.network. _kerberos.some.network. 86400 IN TXT "SOME.NETWORK" _kpasswd._tcp.some.network. 86400 IN SRV 0 100 464 ipa001.pri.some.network. _kpasswd._udp.some.network. 86400 IN SRV 0 100 464 ipa001.pri.some.network. _ldap._tcp.some.network. 86400 IN SRV 0 100 389 ipa001.pri.some.network. ipa-ca.some.network. 86400 IN A 192.168.15.83 ; FreeIPA records END --- And if I make a query to the dns server, it answers as expected: --- [root@indy001 named]# dig @localhost -t TXT _kerberos.some.network ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el8 <<>> @localhost -t TXT _kerberos.some.network ; (2 servers found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62456 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: 8a9f13188f45d098c0a6127a5ebb846645308639d451a496 (good) ;; QUESTION SECTION: ;_kerberos.some.network. IN TXT ;; ANSWER SECTION: _kerberos.some.network. 5 IN TXT "SOME.NETWORK" ;; AUTHORITY SECTION: rpz. 10800 IN NS indy02.pri.some.network . rpz. 10800 IN NS indy001.pri.some.networ k. ;; ADDITIONAL SECTION: indy001.pri.some.network. 10800 IN A 192.168.15.52 indy002.pri.some.network. 10800 IN A 192.168.15.53 ;; Query time: 11 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Wed May 13 07:23:50 CEST 2020 ;; MSG SIZE rcvd: 181 [root@indy001 named]# --- So, any idea what's going on? I think it might be looking for the KDC for PRI.SOME.NETWORK, but I'm not sure and I can't figure out where to look for that info. I've attached the ipaclient-install.log the interesting part is: --- 020-05-12T13:32:04Z DEBUG Starting external process 2020-05-12T13:32:04Z DEBUG args=['/usr/bin/certutil', '-d', 'sql:/tmp/tmpaweq3vf2', '-A', '-n', 'CA certificate 1', '-t', 'C,,', '- a', '-f', '/tmp/t mpaweq3vf2/pwdfile.txt'] 2020-05-12T13:32:05Z DEBUG Process finished, return code=0 2020-05-12T13:32:05Z DEBUG stdout= 2020-05-12T13:32:05Z DEBUG stderr= 2020-05-12T13:32:05Z DEBUG failed to find session_cookie in persistent storage for principal 'host/cli001.pri.some.network(a)SOME.NETWORK' 2020-05-12T13:32:05Z DEBUG trying https://ipa001.pri.some.network/ipa/json 2020-05-12T13:32:05Z DEBUG Created connection context.rpcclient_140399463755392 2020-05-12T13:32:05Z DEBUG [try 1]: Forwarding 'schema' to json server 'https://ipa001.pri.some.network/ipa/json' 2020-05-12T13:32:05Z DEBUG New HTTP connection (ipa001.pri.some.network) 2020-05-12T13:32:05Z DEBUG HTTP connection destroyed (ipa001.pri.some.network) Traceback (most recent call last): File "/usr/lib/python3.6/site- packages/ipaclient/remote_plugins/__init__.py", line 126, in get_package plugins = api._remote_plugins AttributeError: 'API' object has no attribute '_remote_plugins' --- Any ideas much appreciated. /tony -- Tony Albers - Systems Architect - IT Development Royal Danish Library, Victor Albecks Vej 1, 8000 Aarhus C, Denmark Tel: +45 2566 2383 - CVR/SE: 2898 8842 - EAN: 5798000792142

2 2

enable 2FA authentication only in particular host
by Dhinakaran M 13 May '20

13 May '20

As per below scenario trying to enable 2FA but no luck , please let me know if any one faced this kind of issue and how it was resolved I'm trying to enable 2FA authentication only in 2 hosts out-of 5 hosts test case 1 ) I have enabled 2FA in global configuration of FREEIPA but is working on all 5hosts test case 2) Disabled 2FA in Global configuration of freeipa and enabled OTP indicator only 2 hosts but OTP mechanism doesn't working https://www.freeipa.org/page/V4/Authentication_Indicators

2 1

Ansible and ipa-getkeytab issues
by Peter Tselios 12 May '20

12 May '20

Hello, I have a few services that I want to configure for kerberos authentication. I use ansible for this. So, I register the host in IPA, get the OTP, install the ipa-client, create the service and then I need to go to the CLI to download the keytab. I have this in my playbooks: ===================== - name: Download the Keytab block: - name: Login to IPA Master command: echo '{{ ipa_password }}' | kinit admin no_log: true - name: Download the keytab command: > ipa-getkeytab -s {{ ipa_master }} -p HTTP/{{ inventory_hostname }} -k /etc/httpd/http_{{ inventory_hostname }}.keytab ===================== This is failing with the error: ============================== fatal: [server.example.com] FAILED! => changed=true cmd: - ipa-getkeytab - -s - ipamaster.example.com - -p - HTTP/server.example.com - -k - /etc/httpd/http_server.example.com.keytab delta: '0:00:00.005696' end: '2020-05-11 12:43:59.935641' msg: non-zero return code rc: 6 start: '2020-05-11 12:43:59.929945' stderr: Kerberos User Principal not found. Do you have a valid Credential Cache? stderr_lines: <omitted> stdout: '' stdout_lines: <omitted> ============================== However, if I login to the server, issue a ticket (kinit admin), logout and then re-run the playbook succeeds!!! Any idea how to fix this? Obviously I cannot login to each host and then run the playbooks, this is not automation.

4 4

Ansible and ipa-getkeytab
by Peter Tselios 11 May '20

11 May '20

Hello, I have a few services that I want to configure for kerberos authentication. I use ansible for this. So, I register the host in IPA, get the OTP, install the ipa-client, create the service and then I need to go to the CLI to download the keytab. I have this in my playbooks: ===================== - name: Download the Keytab block: - name: Login to IPA Master command: echo '{{ ipa_password }}' | kinit admin no_log: true - name: Download the keytab command: > ipa-getkeytab -s {{ ipa_master }} -p HTTP/{{ inventory_hostname }} -k /etc/httpd/http_{{ inventory_hostname }}.keytab ===================== This is failing with the error: ============================== fatal: [server.example.com] FAILED! => changed=true cmd: - ipa-getkeytab - -s - ipamaster.example.com - -p - HTTP/server.example.com - -k - /etc/httpd/http_server.example.com.keytab delta: '0:00:00.005696' end: '2020-05-11 12:43:59.935641' msg: non-zero return code rc: 6 start: '2020-05-11 12:43:59.929945' stderr: Kerberos User Principal not found. Do you have a valid Credential Cache? stderr_lines: <omitted> stdout: '' stdout_lines: <omitted> ============================== However, if I login to the server, issue a ticket (kinit admin), logout and then re-run the playbook succeeds!!! Any idea how to fix this? Obviously I cannot login to each host and then run the playbooks, this is not automation.

1 0

Re: where to place the freeipa server in a segmented network
by Alex Corcoles 08 May '20

08 May '20

Hi, On Fri, May 8, 2020 at 3:18 PM Angus Clarke via FreeIPA-users < freeipa-users(a)lists.fedorahosted.org> wrote: > We run out IPA infrastructure globally with VPN connected sites, no issue > there. I don't have experience of road warrior VPN clients though. I'm not > sure how IPA behaves when hosts connect with possibly different FQDNs for > example. > I have my laptop joined to a FreeIPA domain and it often moves to different networks where it has different FQDNs. It shows up as hostname.ipadomain in FreeIPA (which doesn't match its name on the networks) and I've never had any issue- I suspect client hostnames are not really important. I do run a publicly accessible FreeIPA instance- it's personal, not commercial, so I'm willing to assume the risks. There are hardening sections in the official docs, although at no point there's explicit information about whether it's safe or not to expose FreeIPA to the Internet. In discussions here I think it's widely considered that you shouldn't do that, though. I'd love that to be a feature, but I understand in most places it's not an issue. Cheers, Álex

1 1

where to place the freeipa server in a segmented network
by Rob van Halteren 08 May '20

08 May '20

Hello, I have network consisting out a LAN,WLAN,DMZ and a PRODUCTION network, separated by a firewall that performs the routing and connections to the outside world. I want to introduce Identity management using a FreeIPA server for my network. Most client machines will be on the LAN network, but not all. Most servers reside on the PRODUCTION network I am trying to figure out where to place the FeeIPA server in this network. I want to be able to authenticate all servers,client machines and also be able to authenticate client machines that are connected via a VPN connection that is hosted on the firewall. Sorry for having to ask this. I have been looking around on the net and this list but found little help on this topic. Any advice would be welcome. Kind regards, Rob.

3 2

Issue with memberOf plugin.
by Mary Georgiou 07 May '20

07 May '20

Hello, In our set-up, we have a DB with all the users and groups, which we use as ground truth for provisioning the forementioned objects in FreeIPA (2 master servers + replicas). We are continuously synchronizing entries (~60000 users and 60000 groups, where groups might have 0 to 20000 members) from the DB to FreeIPA. In each cycle of synch, we are figuring out the differences and add, delete, or change existing entries. The first sync (through which we had to import all 120000 objects) clogged the server totally, and after tweaking the 389DS we ended up disabling the memberOf plugin where it finally worked (we followed the FreeIPA documentation[1]). One of the advice to follow is to do the sync and then run the fixup task in the server where the provisioning happened. The fixup still clogs the server after some point and stops. The errors we get in the log are the following: ``` [06/May/2020:18:16:59.862308719 +0200] - INFO - memberof-plugin - memberof_fixup_task_thread - Memberof task starts (filter: "(|(objectclass=inetuser)(objectclass=inetadmin)(objectclass=nsmemberof))") ... [06/May/2020:20:07:49.545606214 +0200] - ERR - libdb - BDB2055 Lock table is out of available lock entries [06/May/2020:20:07:49.547921580 +0200] - ERR - idl_new_delete_key - idl_new.c BAD 22, err=12 Cannot allocate memory [06/May/2020:20:07:49.548930035 +0200] - ERR - addordel_values_sv - database index operation failed BAD 1130, err=12 Cannot allocate memory [06/May/2020:20:07:49.549779631 +0200] - ERR - addordel_values_sv - database index operation failed BAD 1140, err=12 Cannot allocate memory [06/May/2020:20:07:49.550612745 +0200] - ERR - index_addordel_values_ext_sv - database index operation failed BAD 1230, err=12 Cannot allocate memory [06/May/2020:20:07:49.551444741 +0200] - ERR - index_add_mods - database index operation failed BAD 1041, err=12 Cannot allocate memory [06/May/2020:20:07:49.552457769 +0200] - ERR - index_add_mods - database index operation failed BAD 1040, err=12 Cannot allocate memory [06/May/2020:20:07:49.553305019 +0200] - ERR - ldbm_back_modify - index_add_mods failed, err=12 Cannot allocate memory ``` We increased the number of DB locks and set the `nsslapd-cache-autosize` to 50% (server has currently 13G of memory). The only thing we saw was that one thread was using 100% of one of the CPUs. Any advice on how to deal with this? We would really need to have memberOf attribute. Thank you in advance! Best Regards Mary Georgiou [1] https://www.freeipa.org/page/V4/Performance_Improvements

3 3

no new replicas due to ipa compiled against old samba version on centos 8.1
by Rami Elias (TECH V) 06 May '20

06 May '20

Hello, actually i can't provision new repliacs due to this on Centos 8.1: https://bugs.centos.org/view.php?id=16929 it seems that the ipa package was compiled against an old samba version but this samba in version 4.9.1 seems to be now removed from the mirrors dnf install samba-4.9.1 Failed to set locale, defaulting to C.UTF-8 Last metadata expiration check: 0:04:52 ago on Tue May 5 10:54:57 2020. No match for argument: samba-4.9.1 Error: Unable to find a match: samba-4.9.1 so i tried to download the samba-4.9.1.rpm from here to manually install it, https://koji.mbox.centos.org/koji/buildinfo?buildID=460 but no success because of 403 forbidden .. maybe i should better write this mail to a centos 8 mailing list but i thought i will try first here, because freeipa is the affected tool .. does somebody maybe know another workaround for this? best regards -- ÖAMTC I BAUMGASSE 129 I 1030 WIEN Elias Rami | Devops Engineer M +43 664 613 1346 elias.rami(a)oeamtc.at | www.oeamtc.at<http://www.oeamtc.at/> | ÖAMTC ZVR 7300335108 ________________________________ ÖAMTC Fahrraddiebstahl-Versicherung* Jetzt 6 Monate prämienfrei! Auch online abschließbar. Nur für Mitglieder. https://www.oeamtc.at/versicherung/sachversicherungen/fahrrad-diebstahlvers… *Versicherungsagent: ÖAMTC Betriebe Ges.m.b.H., GISA-Zahl: 23409217 Versicherer: Generali Versicherung AG ________________________________ Wichtiger Hinweis/Important Information: Dieses E-Mail samt Anlagen („E-Mail“) dient nur zur Information. Erklärungen via E-Mail sind nicht rechtsverbindlich, sondern bedürfen der schriftlichen Bestätigung samt firmenmäßiger/statutenmäßiger Unterfertigung durch Mitglieder der Geschäftsleitung in vertretungsbefugter Anzahl. Für die Richtigkeit oder Vollständigkeit der übermittelten Informationen/Daten, für Übermittlungsfehler, für fehlgeleitete E-Mails oder für einen verspäteten Empfang wird nicht gehaftet. Eigene elektronische Empfangs- oder Lesebestätigungen gelten nicht als Bestätigung für den Erhalt eines E-Mails. Der Inhalt dieses E-Mails ist vertraulich. Wenn Sie nicht der angegebene Adressat oder dessen Vertreter sind, informieren Sie bitte umgehend den Absender und löschen Sie dieses E-Mail von Ihrem System. Die unerlaubte Weitergabe oder Nutzung ist nicht gestattet. This e-mail and any attachment (“e-mail”) serves information purposes only. Statements via e-mail are not legally binding but require written confirmation including the signatures of the required number of managing directors under statutory provisions. We are not liable for the accuracy and sufficiency of the provided information/data, for any transmission error, misdirection, loss or delay of an e-mail. Electronic reading receipts are no confirmation for receipt of an e-mail. This e-mail is confidential. If you are not the addressee or his representative, please notify the sender immediately and delete this e-mail from your system. Any disclosure or use is prohibited. ________________________________

3 3

Issue while tying to integrate FreeIPA server (LDAP) with Grafana WebUI
by Saurabh Garg 05 May '20

05 May '20

Hi, I am trying to integrate Grafana UI with LDAP running on FreeIPA, version: 4.8.4. Could you please help me fix the below error: t=2020-05-05T18:15:26+0000 lvl=info msg="Ldap enabled, reading config file" logger=ldap file=/etc/grafana/ldap.toml t=2020-05-05T18:15:26+0000 lvl=eror msg="Error while trying to authenticate user" logger=context userId=0 orgId=0 uname= error="Failed to get LDAP config: Failed to load ldap config file: Near line 34 (last key parsed 'servers.search_base_dns'): expected value but found \"cn\" instead" t=2020-05-05T18:15:26+0000 lvl=eror msg="Request Completed" logger=context userId=0 orgId=0 uname= method=POST path=/login status=500 remote_addr=49.206.255.126 time_ms=0 size=53 referer=http://13.52.184.58:3000/login /etc/grafana/ldap.toml: ################################################## [[servers]] host = "10.0.0.1" port = 389 use_ssl = false start_tls = false ssl_skip_verify = false bind_dn = "uid=binduser,cn=users,cn=accounts,dc=domain,dc=com" bind_password = 'binduser123' search_filter = "(uid=%s)" search_base_dns = [cn=users,cn=accounts,dc=domain,dc=com] group_search_base_dns = [cn=groups,cn=accounts,dc=domain,dc=com] [servers.attributes] name = "givenName" surname = "sn" username = "uid" member_of = "memberOf" email = "mail" [[servers.group_mappings]] group_dn = "cn=grafana-admins,cn=groups,cn=accounts,dc=domain,dc=com" org_role = "Admin" [[servers.group_mappings]] group_dn = "cn=grafana-editors,cn=groups,cn=accounts,dc=domain,dc=com" org_role = "Editor" [[servers.group_mappings]] group_dn = "*" org_role = "Viewer" ################################################## Regards, Saurabh Garg

2 1

Re: Unset passwords for accounts
by Rob Crittenden 05 May '20

05 May '20

Angus Clarke via FreeIPA-users wrote: > Hello > > We don't use FreeIPA passwords for user accounts however some accounts > have had passwords set which is noticed from time to time. I would like > to revert those account passwords to the point when the user was newly > added but the password not yet set. > > I don't see anything obvious in the documentation, perhaps there is some > behind the scenes way of achieving this? (For reference, I used to put > "!!" in /etc/shadow when using local files) There is no equivalent of "no password allowed" in IPA. I think there is or was an RFE for this at one point. To clear out existing password attributes you'd need to use ldapmodify and bind as the Directory Manager to remove them. $ ldapmodify -x -D 'cn=directory manager' -W Enter LDAP Password: dn: uid=tuser1,cn=users,cn=accounts,dc=example,dc=test changetype: modify delete: krbprincipalkey - delete: userpassword - delete: krbextradata - delete: krbpasswordexpiration - delete: krblastpwdchange <extra blank line> ^D rob

2 1

Migrating second IPA server in a two node cluster, to a different VLAN + Masking ipa-client-install password.
by TomK 04 May '20

04 May '20

Hey All, 1) When moving an IPA Cluster member to another VLAN, is it only necessary to change the member's DNS entries in the primary IPA's DNS config, then change the IP on the secondary's network config? Or is there more steps that would need to be done? 2) Can I join an IPA client to an IPA server using an alternate non-previliged account that has minimal permissions, instead of the admin type account? ipa-client-install --force-join -p admin -w "$TMPP" --fixed-primary --server=$IPA01.$NDOMAIN --server=$IPA02.$NDOMAIN --domain=$NDOMAIN --realm=$UNDOMAIN -U I've created a user with a role that has Host Enrollment and Host Administrators. However, perhaps Host Administrators will give too many permissions, including removal of existing hosts. Wondering if there isn't a more restrictive set of permissions I could give. -- Thx, TK.

2 1

Unset passwords for accounts
by Angus Clarke 04 May '20

04 May '20

Hello We don't use FreeIPA passwords for user accounts however some accounts have had passwords set which is noticed from time to time. I would like to revert those account passwords to the point when the user was newly added but the password not yet set. I don't see anything obvious in the documentation, perhaps there is some behind the scenes way of achieving this? (For reference, I used to put "!!" in /etc/shadow when using local files) Thanks a lot Angus

1 0

Users and Admin access for AD Accounts
by TomK 03 May '20

03 May '20

Hey All, Let's suppose I have two AD groups: unixadmin unixusers In FreeIPA, I would like to give unixadmin group access to ALL FreeIPA functions. Whereas for the unixusers, I would like to give R/O access. I've already done the group mappings from AD to FreeIPA. What is the best way to achieve this? I'm finding related links online but not quite what I'm looking for. I did a test to see if nesting the unixadmin group within the FreeIPA admins group would work but I still can't login to FreeIPA with my AD user, despite my ID residing in the unixadmin group which in turn is nested in the FreeIPA admins group. This is FreeIPA 4.6.4 . -- Thx, TK.

2 2

failed to verify krb5 credentials: Server not found in Kerberos database
by Faraz Younus 01 May '20

01 May '20

HI Team, I'm getting subjected on when enrolled to new FreeIPA how can it be fixed ?

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2020