Help with access scenario
by Dominik Vogt
Hi Folks,
I need some hints on the following scanario:
* We have a cluster of ipa clients and an ipa server.
* There is an _ipa_ user with the name "BIGBOSS".
* There is also a machine EXT that may be connected to the cluster
for maintenance purposes, but it is not an ipa client.
Some user on EXT uses ssh to connect to the local user named LOCAL
on the cluster machine C. From there she can type
$ su -c /bin/bash BIGBOSS
to switch to the BIGBOSS user on C (with password login).
--
Now, I have no idea how to do this:
* Only the users "root" and LOCAL are allowed to use "su" to
switch to BIGBOSS. All other local and ipa user must not be
able to "su -c ... BIGBOSS", even if they know the password.
Ciao
Dominik ^_^ ^_^
--
Dominik Vogt
2 years, 11 months
delegate management of dns record
by Natxo Asenjo
hi,
I can delegate the management of a whole zone to a user, but is it possible
to delegate just one record to a user?
We want to automatically populate a srv record, and do not want to use the
admin user for this, hence the question. I do not want to delegate the
whole zone either.
Thanks in advance.
--
--
Groeten,
natxo
2 years, 11 months
FreeIPA and passwordless logins
by Tony Brian Albers
Hiya,
I'm trying to set up a host where users can only log on using ssh keys.
But the users must be known in FreeIPA.
So, how do I go about disabling password-based logins? I only want to
allow key-based logins.
TIA
/tony
2 years, 11 months
HBAC and Sudo Rules
by Ash Ryder
I have setup a HBAC rule for a specific AD group to be able to run all services on all hosts however i am unable to sudo once logged in. Im sure it was working at some point.. but am not sure if it was because i had a sudo rule in place which has now been removed. Do i need to run Sudo rules alongside HBAC or should it just override?
When i run HBAC test for the sudo service on my host it shows "Access Granted" but this doesn't reflect on the client when i try to use the sudo command. Does it take some time to sync or is there a way for refresh it manually? i dont know if i have made to many changes and just need to wait for it to settle down.
Thanks as always,
Ash
2 years, 11 months
Revert to non-commercial https cert
by Dungan, Scott A.
To smooth the transition NIS to FreeIPA, we enabled migration mode and installed commercial certificates on the IPA servers following the documented "ipa-server-certinstall -http" command. Now that the migration is complete, while not horrible, renewing the commercial certificates every year is a task that could be very disruptive if not completed on time. My question is it possible to revert to a self-signed web cert from the IPA CA so that Dogtag handles the renewals automatically?
Thanks!
2 years, 11 months
Freeipa upgrade failed: NoOptionError: Section [domain.tld] has no option [ipa_server_mode]
by Giovanni Bechis
Hi,
running latest FreeIPA upgrade I encountered an error and the freeipa upgrade failed.
The upgrade script tries to add [ipa_server_mode] to my sssd.conf domain section but it fails even if /etc/sssd.conf
has those options set.
Atm I am running ipa-server-4.6.8-5.el7.centos.5.x86_64 and my sssd.conf file is the following:
-------------------------------------------------------------------------------------------------------------------------
[sssd]
domains = domain.tld
config_file_version = 2
services = nss, ifp, pam, ssh
[domain/domain.tld]
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldaps://srv.domain.tld
ldap_user_search_base = cn=users,cn=accounts,dc=domain,dc=tld
ldap_group_search_base = cn=groups,cn=compat,dc=domain,dc=tld
ldap_default_bind_dn = uid=ldapdn,cn=users,cn=compat,dc=domain,dc=tld
ldap_default_authtok = XXX
ldap_id_use_start_tls = True
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_cacert = /etc/openldap/cacerts/ca.crt
ldap_tls_reqcert = allow
ldap_user_ssh_public_key = ipaSshPubKey
cache_credentials = True
enumerate = True
[ifp]
allowed_uids = ipaapi, root
-------------------------------------------------------------------------------------------------------------------------
I am using FreeIPA only as an ldap web gui, all my services are using ldaps protocol.
By commenting the relevant lines in "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py"
the upgrade proceeds and all works fine.
Is there any way to prevent the upgrade script from crashing every time ?
Thanks
Giovanni
2 years, 11 months
Help troubleshooting ipa-upgrade
by John Obaterspok
Hi,
I have been trying now for a month getting ipa-upgrade going on my
single host IPADOM. Any idea what to do would be greatly appreciated
-- ipaupgrade log --
2021-05-04T04:25:02Z DEBUG args=['/bin/systemctl', 'stop',
'dirsrv(a)IPADOM-LAN.service']
2021-05-04T04:25:06Z DEBUG Process finished, return code=0
2021-05-04T04:25:06Z DEBUG stdout=
2021-05-04T04:25:06Z DEBUG stderr=
2021-05-04T04:25:06Z DEBUG Stop of dirsrv(a)IPADOM-LAN.service complete
2021-05-04T04:25:06Z INFO [Fix DS schema file syntax]
2021-05-04T04:25:06Z DEBUG Loading StateFile from
'/var/lib/ipa/sysupgrade/sysupgrade.state'
2021-05-04T04:25:06Z INFO Syntax already fixed
2021-05-04T04:25:06Z INFO [Removing RA cert from DS NSS database]
2021-05-04T04:25:21Z DEBUG Loading StateFile from
'/var/lib/ipa/sysupgrade/sysupgrade.state'
2021-05-04T04:25:21Z INFO RA cert already removed
2021-05-04T04:25:21Z DEBUG Starting external process
2021-05-04T04:25:21Z DEBUG args=['/bin/systemctl', 'start',
'dirsrv(a)IPADOM-LAN.service']
2021-05-04T04:25:24Z DEBUG Process finished, return code=0
2021-05-04T04:25:24Z DEBUG stdout=
2021-05-04T04:25:24Z DEBUG stderr=
2021-05-04T04:25:24Z DEBUG Starting external process
2021-05-04T04:25:24Z DEBUG args=['/bin/systemctl', 'is-active',
'dirsrv(a)IPADOM-LAN.service']
2021-05-04T04:25:24Z DEBUG Process finished, return code=0
2021-05-04T04:25:24Z DEBUG stdout=active
2021-05-04T04:25:24Z DEBUG stderr=
2021-05-04T04:25:24Z DEBUG wait_for_open_ports: localhost [389] timeout 120
2021-05-04T04:25:24Z DEBUG waiting for port: 389
2021-05-04T04:25:24Z DEBUG SUCCESS: port: 389
2021-05-04T04:25:24Z DEBUG Start of dirsrv(a)IPADOM-LAN.service complete
...
2021-05-04T04:25:41Z INFO [Migrating certificate profiles to LDAP]
2021-05-04T04:26:01Z DEBUG Created connection context.ldap2_140042743094296
2021-05-04T04:26:01Z DEBUG flushing
ldapi://%2fvar%2frun%2fslapd-IPADOM-LAN.socket from SchemaCache
2021-05-04T04:26:01Z DEBUG retrieving schema for SchemaCache
url=ldapi://%2fvar%2frun%2fslapd-IPADOM-LAN.socket
conn=<ldap.ldapobject.SimpleLDAPObject object at 0x7f5e3d65c9b0>
2021-05-04T04:26:02Z DEBUG Destroyed connection context.ldap2_140042743094296
2021-05-04T04:26:02Z DEBUG request GET
https://ipa2.ipadom.lan:8443/ca/rest/account/login
2021-05-04T04:26:02Z DEBUG request body ''
2021-05-04T04:26:02Z DEBUG response status 500
2021-05-04T04:26:02Z DEBUG response headers Content-Type:
text/html;charset=utf-8
Content-Language: en
Content-Length: 2234
Date: Tue, 04 May 2021 04:26:02 GMT
Connection: close
2021-05-04T04:26:02Z DEBUG response body (decoded):<..snip..> CA
subsystem unavailable. Check CA debug log
----------------
04-May-2021 06:26:02.535 SEVERE [https-jsse-nio-8443-exec-5]
org.apache.catalina.core.StandardHostValve.invoke Exception Processing
/ca/rest/account/login
javax.ws.rs.ServiceUnavailableException: CA subsystem
unavailable. Check CA debug log.
at
com.netscape.cms.tomcat.ProxyRealm.validateRealm(ProxyRealm.java:81)
at
com.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(ProxyRealm.java:149)
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:530)
at
com.netscape.cms.tomcat.ExternalAuthenticationValve.invoke(ExternalAuthenticationValve.java:82)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
at
org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:678)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
at
org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:367)
at
org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
at
org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:860)
at
org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1598)
at
org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)
-- CA: --
2021-05-04 06:25:08 [main] FINE: ============================================
2021-05-04 06:25:08 [main] FINE: ===== DEBUG SUBSYSTEM INITIALIZED =======
2021-05-04 06:25:08 [main] FINE: ============================================
2021-05-04 06:25:08 [main] INFO: Initializing CA subsystem
2021-05-04 06:25:08 [main] FINEST: Getting cs.state=1
2021-05-04 06:25:08 [main] FINEST: Getting instanceRoot=/var/lib/pki/pki-tomcat
2021-05-04 06:25:08 [main] FINEST: Getting instanceId=pki-tomcat
...
2021-05-04 06:25:10 [main] FINE: LdapBoundConnection: Connecting to
ipa2.ipadom.lan:636 with client cert auth
2021-05-04 06:25:10 [main] FINE: ldapconn/PKISocketFactory.makeSSLSocket: begins
2021-05-04 06:25:10 [main] FINE: SignedAuditLogger: event
CLIENT_ACCESS_SESSION_ESTABLISH
2021-05-04 06:25:10 [main] FINEST: Getting pidDir=/var/run/pki/tomcat
2021-05-04 06:25:10 [main] FINEST: Getting pidDir=/var/run/pki/tomcat
2021-05-04 06:25:10 [main] SEVERE: Unable to create socket:
java.net.ConnectException: Connection refused
java.net.ConnectException: Connection refused
at java.net.PlainSocketImpl.socketConnect(Native Method)
2 years, 11 months
Disable SSH password authentication for all non-subnet IP addresses
by Eamon Doyle
I am trying to require ssh keys for SSH connections that originate outside of a subnet but allowing password auth within a subnet. Before setting up FreeIPA, I did this by setting the following in my sshd_config:
PasswordAuthentication no
Match Address 172.16.0.*
PasswordAuthentication yes
After setting up FreeIPA, this configuration seems to be ignored. Instead, password authentication seems to be allowed from any connection if key-based auth fails. I presume I need to make changes to the sssd configuration but I'm having trouble finding any info on achieving this. Any info would be helpful.
2 years, 11 months
Use of certificates to have https secure connection
by G Col
Hello,
I have configured and installed freeipa, but I have some issues trying to add the certificates to freeipa configuration to get https correctly setup.
I have my own .key .crt and an additional .crt certificates as follows the use of wildcard certificates. Following this guide, it didn't help as in my case I do use 3 files related with the certificate configuration.
https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP
ipa-server-certinstall -w -d mysite.key mysite.crt
(But I use 3 files, also running the command asks for a passphrase key, but my certs don't have any passphrase key associated. How I did it in the past was to add the route of those files in the virtualhost section of the config file for the web service, but in this case I am not 100% sure which procedures we have apart of the command above that may not work for my case.
I would really appreciate your thoughts on this.
Thank you so much,
2 years, 11 months
AD trust - filter groups to speed up the Active Directory search
by iulian roman
Is there any method to "filter" or mask some Active Directory groups in order to speed up the lookup/search in AD ? For example I am interested only on few groups (max. 10) and all the rules will be based on those groups. I do not want to display all hundreds of groups a user is member of, but only those 5-10 which are relevant for ipa rbac rules and which I can predefine upfront. The only reason I would like to do that is to speed up or reduce the lookup time in AD (it can take up to 10-15 seconds for users which are member of few hundred groups).
I have tried most of the tunings recommended but I could not reduce it significantly.
2 years, 11 months
