FreeIPA-users February 2021

freeipa-users@lists.fedorahosted.org

44 participants
74 discussions

Re: [EXTERNAL] Separate Topic -- FreeIPA and RADIUS
by White, Daniel E. (GSFC-770.0)[NICS] 22 Feb '21

22 Feb '21

Mariusz, I do not want to hijack your thread, so I am starting another. I would be very interested to know your FreeIPA/RADIUS configuration. ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov> NASCOM Linux Engineer NASA Goddard Space Flight Center Science Applications International Corporation (SAIC) Office: (301) 286-6919 Mobile: (240) 513-5290 From: FreeIPA-Users <freeipa-users(a)lists.fedorahosted.org> Reply-To: FreeIPA-Users <freeipa-users(a)lists.fedorahosted.org> Date: Friday, February 19, 2021 at 08:51 To: FreeIPA-Users <freeipa-users(a)lists.fedorahosted.org> Cc: Mariusz Stysiak <server.is.not.responding(a)gmail.com> Subject: [EXTERNAL] [Freeipa-users] MFA for AD users Hello List, I'd really appreciate some insight here. I've setup FreeIpa POC (centos7, freeipa 4.7, two freeipa servers as multimaster along with some clients). Added OTP's for several users and made it work with RADIUS for vpn access authentication purpose. Next, I've added AD trust and I am able to log in as AD user. All groovy. Now I'd like to enforce MFA for AD users by adding OTP tokens for them. Is it possible at all? Since AD user authenticates against AD, shouldn't it be AD who provides MFA? FreeIPA behaves strangely when it comes to AD users (mapped via external group and POSIX group): AD user 'ipatest' is visible with 'id' command (and has it's own UID GID and so on) but cannot be found via 'ipa user-find' command even with specific UID provided: admin@ipa-poc-1 ~ $ id ipatest(a)lab.trusteddomain.com<mailto:ipatest@lab.trusteddomain.com> uid=748801177(ipatest(a)lab.trusteddomain.com<mailto:ipatest@lab.trusteddomain.com>) gid=748801177(ipatest(a)lab.trusteddomain.com<mailto:ipatest@lab.trusteddomain.com>) groups=748801177(ipatest(a)lab.trusteddomain.com<mailto:ipatest@lab.trusteddomain.com>),748800513(domain users(a)lab.trusteddomain.com<mailto:users@lab.trusteddomain.com>),748801180(linuxusers(a)lab.trusteddomain.com<mailto:linuxusers@lab.trusteddomain.com>),793600008(ad_users) admin@ipa-poc-1 ~ $ ipa user-find ipatest --------------- 0 users matched --------------- ---------------------------- Number of entries returned 0 ---------------------------- admin@ipa-poc-1 ~ $ ipa user-find ipatest(a)lab.trusteddomain.com<mailto:ipatest@lab.trusteddomain.com> --------------- 0 users matched --------------- ---------------------------- Number of entries returned 0 ---------------------------- admin@ipa-poc-1 ~ $ ipa user-find ipatest@TRUSTEDOMAIN-LAB --------------- 0 users matched --------------- ---------------------------- Number of entries returned 0 admin@ipa-poc-1 ~ $ ipa user-find uid=748801177 --------------- 0 users matched --------------- ---------------------------- Number of entries returned 0 ---------------------------- I reckon it is due to the one-way trust with AD domain but not sure here. Since "ipa otptoken-add' command requires 'owner' parameter (type string and doesn't work with UID) I cannot add OTP token for this user. Another approach I've tried (since ipa otptoken-add command by default uses current user as owner) was to log on as AD user and create OTP token 'for myself', but it didn't work either: ipatest(a)lab.trusteddomain.com<mailto:ipatest@lab.trusteddomain.com>@ipa-poc-1 ~ $ kinit ipatest(a)lab.trusteddomain.com<mailto:ipatest@lab.trusteddomain.com> Password for ipatest(a)lab.trusteddomain.com<mailto:ipatest@lab.trusteddomain.com>: ipatest(a)lab.trusteddomain.com<mailto:ipatest@lab.trusteddomain.com>@ipa-poc-1 ~ $ ipa otptoken-add --type='TOTP' ipa: ERROR: cannot connect to 'any of the configured servers': https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fipa-poc-1…, https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fipa-poc-2… So, to make it short: Is it possible to add OTP token to external AD user? How to do it? rgrds M. _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo… List Guidelines: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro… List Archives: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed… Do not reply to spam on the list, report it: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpagure.io…

2 2

MFA for AD users
by Mariusz Stysiak 22 Feb '21

22 Feb '21

Hello List, I'd really appreciate some insight here. I've setup FreeIpa POC (centos7, freeipa 4.7, two freeipa servers as multimaster along with some clients). Added OTP's for several users and made it work with RADIUS for vpn access authentication purpose. Next, I've added AD trust and I am able to log in as AD user. All groovy. Now I'd like to enforce MFA for AD users by adding OTP tokens for them. Is it possible at all? Since AD user authenticates against AD, shouldn't it be AD who provides MFA? FreeIPA behaves strangely when it comes to AD users (mapped via external group and POSIX group): AD user 'ipatest' is visible with 'id' command (and has it's own UID GID and so on) but cannot be found via 'ipa user-find' command even with specific UID provided: admin@ipa-poc-1 ~ $ id ipatest(a)lab.trusteddomain.com uid=748801177(ipatest(a)lab.trusteddomain.com) gid=748801177(ipatest(a)lab.trusteddomain.com) groups=748801177(ipatest(a)lab.trusteddomain.com),748800513(domain users@lab.trusteddomain.com),748801180(linuxusers@lab.trusteddomain.com),793600008(ad_users) admin@ipa-poc-1 ~ $ ipa user-find ipatest --------------- 0 users matched --------------- ---------------------------- Number of entries returned 0 ---------------------------- admin@ipa-poc-1 ~ $ ipa user-find ipatest(a)lab.trusteddomain.com --------------- 0 users matched --------------- ---------------------------- Number of entries returned 0 ---------------------------- admin@ipa-poc-1 ~ $ ipa user-find ipatest@TRUSTEDOMAIN-LAB --------------- 0 users matched --------------- ---------------------------- Number of entries returned 0 admin@ipa-poc-1 ~ $ ipa user-find uid=748801177 --------------- 0 users matched --------------- ---------------------------- Number of entries returned 0 ---------------------------- I reckon it is due to the one-way trust with AD domain but not sure here. Since "ipa otptoken-add' command requires 'owner' parameter (type string and doesn't work with UID) I cannot add OTP token for this user. Another approach I've tried (since ipa otptoken-add command by default uses current user as owner) was to log on as AD user and create OTP token 'for myself', but it didn't work either: ipatest@lab.trusteddomain.com@ipa-poc-1 ~ $ kinit ipatest(a)lab.trusteddomain.com Password for ipatest(a)lab.trusteddomain.com: ipatest@lab.trusteddomain.com@ipa-poc-1 ~ $ ipa otptoken-add --type='TOTP' ipa: ERROR: cannot connect to 'any of the configured servers': https://ipa-poc-1.lab/ipa/json, https://ipa-poc-2.lab/ipa/json So, to make it short: Is it possible to add OTP token to external AD user? How to do it? rgrds M.

2 4

ipa-client-install returns success, but auth isn't working
by Braden McGrath 19 Feb '21

19 Feb '21

I have a 3-server (replicating) FreeIPA environment running on CentOS7. ipa --version shows: VERSION: 4.6.8, API_VERSION: 2.237 I have successfully "joined" two Ubuntu Server 20.04 LTS clients to the FreeIPA environment without issue. Let's call those Alpha and Beta. Alpha and Beta were installed using Ubuntu's freeipa packages; they show ipa --version: VERSION: 4.8.6, API_VERSION: 2.236 Alpha and Beta work as expected, even though their client version is newer than the servers. I now have a 3rd Ubuntu Server 20.04 LTS VM ("Gamma") that I am trying to enroll/setup, and ipa-client-install returns success, but near the end of the install, 'getent' fails to pull info about the user account that was used during the install, and I can't login to this VM with an account from the FreeIPA database. I looked through the install log and didn't see anything obvious, but I've also only installed freeipa on 5 other systems at this point, so I don't really know what to look for. :) Key differences between Alpha/Beta and Gamma: Alpha/Beta are both VMs installed from a Ubuntu 20.04 LTS ISO; Gamma is an Ubuntu "cloud-image" VM (cloned from their image and then run through cloud-init for a hostname/etc) Alpha/Beta are using static IP addresses with manual DNS configuration; Gamma is using DHCP, but has a reservation (the IP won't change). DHCP is issuing the IPs of the 3 FreeIPA server VMs as DNS servers, and the DNS search domain is correct. Note that all 3 Ubuntu systems *are* still using Systemd-Resolve for DNS, which is then sending queries to the CentOS 7 Servers. Alpha and Beta are fine with this, so I don't think systemd-resolve is the problem. Any help would be greatly appreciated, because I'm not sure what to look at next (and I also don't understand why what should be a nearly identical install is not working). Rather than attaching the entirety of ipaclient-install.log, here is a github gist link with it. I've sanitized the domain, hostname, enroll username, and kerberos realm, but everything else has not been touched. https://gist.github.com/ZPrimed/1040499a744286690745a7d93bcd3d10

2 5

[SSSD-users] Announcing SSSD 2.4.2
by Pavel Březina 19 Feb '21

19 Feb '21

# SSSD 2.4.2 The SSSD team is proud to announce the release of version 2.4.2 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.4.2 See the full release notes at: https://sssd.io/docs/users/relnotes/notes_2_4_2 RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### General information * Default value of 'user' config option was fixed into accordance with man page, i.e. default is 'root' * Example systemd service configs now makes use of CapabilityBoundingSet option as a security hardening measure. ### New features * `pam_sss_gss` now support authentication indicators to further harden the authentication ### Configuration changes * Added `pam_gssapi_indicators_map` to configure authentication indicators requirements

1 0

Creating Certs for Services
by Techmail 19 Feb '21

19 Feb '21

Hello! I'm setting up a RabbitMQ server on our internal network, and I thought now would be a good time to figure out how to use FreeIPA to issue certs for services to enable TLS. (Only internal systems with the IPA cert will access the system.) However, I'm running into a couple of problems. I'm following the FreeIPA PKI Docs [1] on how to setup an automated cert request with Certmonger which will put cert renewal on autopilot, hopefully, and I'm getting stuck on step #6 of the instructions where I'm supposed to import the IPA `ca.crt` into the nssdb which was created for RabbitMQ. Command and results of step #6: ``` [me(a)rabbitserver.sub.domain.tld]# certutil -A -d /etc/rabbitmq/nssdb -n 'SUB.DOMAIN.TLD IPA CA' -t CT,, -a < /etc/ipa/ca.crt Enter Password or Pin for "NSS Certificate DB": ``` I don't know what password or pin it would like. I read something which suggested `/etc/dirsrv/slapd-DOMAIN-TLD/pin.txt` on the IPA server contained the magic words which would unlock the database, so I copied the token which is not what certutil wants to unlock `/etc/ipa/nssdb`. Example contents of `/etc/ipa/nssdb/pin.txt` on IPA server: ``` Internal (Software) Token:<thispartiswhaticopied> ``` Here are the problems: 1. I don't know the PIN or password for `/etc/ipa/nssdb`. 2. Would like the cert to be auto managed. 3. FreeIPA docs and RHEL docs disagree. [2][3] IPA Server: * CentOS 7 * ipa-server: 4.6.8-5.el7.centos Rabbit Server: * CentOS Stream 8 * ipa-client: 4.9.0-1.module_el8.4.0+635+535c2b80 Ryan 1: https://www.freeipa.org/page/PKI#Automated_certificate_requests_with_Certmo… 2: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… 3: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht…

2 1

Something changed regarding enrollment permissions?
by Ronald Wimmer 18 Feb '21

18 Feb '21

Today we did not manage to enroll new hosts with our enrollment user. The only thing we changed is that we added the Permission "System: Remove hosts" to the "Host Enrollment" role. The error we get is: Joining realm failed: Failed to parse result: Insufficient access rights Retrying with pre-4.0 keytab retrieval method... Failed to parse result: Insufficient access rights Failed to get keytab! Failed to get keytab child exited with 9 When I try to add the same host with my admin user it works without any problems. Cheers, Ronald

2 2

Set "Description" on ipa-client-install
by Russ Long 18 Feb '21

18 Feb '21

Is there a way, when using ipa-client-install, to set the Description field for a server? If not, is "ipa host-mod" the preferred method to set this after install?

3 3

Question about AD trust and yum IPA server upgrade
by John Desantis 18 Feb '21

18 Feb '21

Hello all, I couldn't easily find a direct answer regarding a yum upgrade of the IPA server with an active AD trust, so I'll just ask here. When one performs a yum upgrade of the IPA server, does the AD trust have to be re-established? Thanks, John DeSantis

3 3

Unable to install ipa client centos 7.5.1804 (Core)
by William Graboyes 17 Feb '21

17 Feb '21

Hello List, I have been searching around for the day and have found an answer for the error I am getting when I am trying to install the client on a brand new install: Version: ipa-client-4.5.4-10.el7.centos.3.x86_64 ipa-client-common-4.5.4-10.el7.centos.3.noarch The error is below (run as root, not via sudo): ipa-client-install Traceback (most recent call last): File "/sbin/ipa-client-install", line 22, in <module> from ipaclient.install import ipa_client_install File "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_client_install.py", line 5, in <module> from ipaclient.install import client File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 34, in <module> from ipalib import api, errors, x509 File "/usr/lib/python2.7/site-packages/ipalib/x509.py", line 45, in <module> from pyasn1_modules import rfc2315, rfc2459 File "/usr/lib/python2.7/site-packages/pyasn1_modules/rfc2315.py", line 67, in <module> class DigestedData(univ.Sequence): File "/usr/lib/python2.7/site-packages/pyasn1_modules/rfc2315.py", line 72, in DigestedData namedtype.NamedType('digest', Digest) File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 115, in __init__ self.__ambiguousTypes = 'terminal' not in kwargs and self.__computeAmbiguousTypes() or {} File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 232, in __computeAmbiguousTypes ambigiousTypes[idx] = NamedTypes(*partialAmbigiousTypes, **dict(terminal=True)) File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 114, in __init__ self.__tagToPosMap = self.__computeTagToPosMap() File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 205, in __computeTagToPosMap for _tagSet in tagMap.presentTypes: AttributeError: 'property' object has no attribute 'presentTypes' Any help would be greatly appreciated. Thanks, Bill G.

3 2

FreeIPA certificate doesn't validate in iOS
by Jochen Kellner 16 Feb '21

16 Feb '21

Hello, I'm running IPA on current Fedora 32, freeipa-server-4.8.9-2 and pki-server-10.9.0-0.4 Today the certificate of my IMAP server (running on Debian Buster) was automatically refreshed: ,---- | Request ID '20181003215953': | status: MONITORING | stuck: no | key pair storage: type=FILE,location='/etc/ssl/private/imap.jochen.org.key' | certificate: type=FILE,location='/etc/ssl/certs/imap.jochen.org.crt' | CA: IPA | issuer: CN=Certificate Authority,O=JOCHEN.ORG | subject: CN=imap.jochen.org,O=JOCHEN.ORG | expires: 2022-09-07 09:30:16 CEST | dns: imap.jochen.org | principal name: imap/jupiter.jochen.org(a)JOCHEN.ORG | key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment | eku: id-kp-serverAuth,id-kp-clientAuth | pre-save command: | post-save command: /root/refresh_cyrus_certificate.sh | track: yes | auto-renew: yes `---- On an iPhone one of my users gets a message that the certificate is not valid. Reason seems to be this: https://7402.org/blog/2019/new-self-signed-ssl-cert-ios-13.html When I look at the certificate with openssl I see: ,---- | X509v3 extensions: | X509v3 Authority Key Identifier: | keyid:4F:F8:45:3D:E8:06:4B:8D:BB:9D:D2:D1:8B:00:43:A1:07:16:A1:17 | | Authority Information Access: | OCSP - URI:http://ipa-ca.jochen.org/ca/ocsp | | X509v3 Key Usage: critical | Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment | X509v3 Extended Key Usage: | TLS Web Server Authentication, TLS Web Client Authentication `---- My current guess is that the "Key Usage: critical" is the reason for the iOS error. I've looked for the certprofiles and found these files: ,---- | [root@freeipa3 /]# find . -name \*caIPAserviceCert\* -ls | 8510694 8 -rw-rw---- 1 pkiuser pkiuser 6218 Mär 4 2020 ./var/lib/pki/pki-tomcat/ca/profiles/ca/caIPAserviceCert.cfg | 9332162 4 -rw-r--r-- 1 root root 229 Aug 20 12:38 ./usr/lib/python3.8/site-packages/ipaclient/csrgen/profiles/caIPAserviceCert.json | 26138015 8 -rw-r--r-- 1 root root 7014 Aug 20 12:37 ./usr/share/ipa/profiles/caIPAserviceCert.UPGRADE.cfg | 26138016 8 -rw-r--r-- 1 root root 7294 Aug 20 12:37 ./usr/share/ipa/profiles/caIPAserviceCert.cfg | 9323278 8 -rw-r--r-- 1 root root 6272 Jun 25 23:53 ./usr/share/pki/ca/profiles/ca/caIPAserviceCert.cfg `---- These files contain: ,---- | policyset.serverCertSet.6.constraint.params.keyUsageCritical=true | policyset.serverCertSet.6.constraint.params.keyUsageDigitalSignature=true | policyset.serverCertSet.6.constraint.params.keyUsageNonRepudiation=true | policyset.serverCertSet.6.constraint.params.keyUsageDataEncipherment=true | policyset.serverCertSet.6.constraint.params.keyUsageKeyEncipherment=true | policyset.serverCertSet.6.constraint.params.keyUsageKeyAgreement=false `---- So I think this is where the critical comes from and the keyUsage defaults come from. What I could use help with is the following: 1. I didn't find reports about the problem in pagure or the mailing list. Am I really alone with this? 2. My FreeIPA has been installed years ago on Fedora, moved to CentOS and this year back to Fedora by creating replicas. Has there been a problem with upgrading the certprofiles? 3. How can I remove the options from the certificate request so that certmonger gets a valid certificate? Do I miss something else? -- This space is intentionally left blank.

4 16

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2021