SSH with password fails - 7 (Authentication failure)
by lejeczek
Hi guys.
This have puzzled my and left clueless.
It's a fresh new deployment and still only single master.
Very first & only user and I cannot 'ssh' with password -
but krb ticket I can obtain and 'ssh' with it successfully.
ssh logs:
..
pam_sss(sshd:auth): received for user bs58: 7
(Authentication failure)
..
with in: /etc/sssd/sssd.conf
[pam]
debug_level=9
only fail/error/warn in sssd_pam.log is:
..
(2022-01-16 12:20:18): [pam] [pam_print_data] (0x0100): [CID
#6] service: sshd
(2022-01-16 12:20:18): [pam] [pam_print_data] (0x0100): [CID
#6] tty: ssh
(2022-01-16 12:20:18): [pam] [pam_print_data] (0x0100): [CID
#6] ruser: not set
(2022-01-16 12:20:18): [pam] [pam_print_data] (0x0100): [CID
#6] rhost: 10.0.0.16
(2022-01-16 12:20:18): [pam] [pam_print_data] (0x0100): [CID
#6] authtok type: 1 (Password)
(2022-01-16 12:20:18): [pam] [pam_print_data] (0x0100): [CID
#6] newauthtok type: 0 (No authentication token available)
(2022-01-16 12:20:18): [pam] [pam_print_data] (0x0100): [CID
#6] priv: 1
(2022-01-16 12:20:18): [pam] [pam_print_data] (0x0100): [CID
#6] cli_pid: 25363
(2022-01-16 12:20:18): [pam] [pam_print_data] (0x0100): [CID
#6] logon name: bs583
(2022-01-16 12:20:18): [pam] [pam_print_data] (0x0100): [CID
#6] flags: 2
(2022-01-16 12:20:18): [pam] [pam_dom_forwarder] (0x0100):
pam_dp_send_req returned 0
(2022-01-16 12:20:18): [pam] [sbus_dispatch] (0x4000):
Dispatching.
(2022-01-16 12:20:18): [pam] [pam_dp_send_req_done]
(0x0200): received: [7 (Authentication
failure)][ccn.private.com][CID #6]
(2022-01-16 12:20:18): [pam] [pam_reply] (0x4000): pam_reply
initially called with result [7]: Authentication failure.
this result might be changed during processing
(2022-01-16 12:20:18): [pam] [pam_reply] (0x0200): blen: 43
(2022-01-16 12:20:18): [pam] [pam_reply] (0x0200): Returning
[7]: Authentication failure to the client [CID #6]
(2022-01-16 12:20:20): [pam] [client_recv] (0x0200): Client
disconnected!
...
It's on Centos 8 with:
ipa-server-4.9.6-10.module_el8.5.0+1055+c415bbe9.x86_64
sssd-ipa-2.5.2-2.el8_5.3.x86_64
krb5-libs-1.18.2-14.el8.x86_64
I've tried higher 'debug_level' for other bits in
'/etc/sssd/sssd.conf' but there it nothing 'abnormal' there
- or I've gone blind.
All & any suggestions on how to troubleshoot/fix this very
much appreciated.
many thanks, L.
2 years, 3 months
Use 389-ds as freeipa mirror
by Jim Kinney
Since SuSE doesn't support FreeIPA/IdM, and I need to use freeipa as master controller, I need to be able to have multiple suse hosted 389-ds ldap servers (9) be read-only mirrors for large numbers of compute node clients (3000).
I have VMs on suse hosts running rocky8.5 for freeipa as test servers. Those nodes sync fine. I have 389-ds on a single suse host for sync testing. I created replication agreements using docs on suse site for sles15 sp3 and verified no firewall blocks between them.
https://documentation.suse.com/sles/15-SP3/html/SLES-all/cha-security-lda...
The sync connects but no data is transferred. I suspect the cause is the 389 system has no schema like freeipa to sync into.
Next attempt is to perform an ldif backup of the ipa system and restore it to the 389 system. I have concerns about this as there's probably a unique system id in the backup (I've not grep'ed through it yet). Is this a reasonable process?
This is all still experimental and everything can(will) be wiped and reinstalled(multiple times as the process is developed). If there are docs on how to sync these, I've not found them and would really appreciate links
The alternative is to install freeipa containers on the sles systems but the container readme on github reads like it's still very experimental.
Also as there is no freeipa client package in sles, just sssd-ipa and libhbac0, all of the sssd configuration will be manual as well as all the certificates between freeipa servers and sles clients.
--
Computers amplify human error
Super computers are really cool
2 years, 3 months
IPA broken after dnf update on CentOS 8
by Vinícius Ferrão
Hello, I’ve a single IPA machine that provides authentication for itself. It does not even have any client or host.
After def -y update and reboot, IPA fails to load an it’s in broken state.
[root@headnode ~]# systemctl status ipa
● ipa.service - Identity, Policy, Audit
Loaded: loaded (/usr/lib/systemd/system/ipa.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Wed 2021-01-06 16:14:48 -03; 45min ago
Process: 1278 ExecStart=/usr/sbin/ipactl start (code=exited, status=1/FAILURE)
Main PID: 1278 (code=exited, status=1/FAILURE)
Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: CRL tree already moved
Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command i>
Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: Unexpected error - see /var/log/ipaupgrade.log for details:
Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', '>
Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more >
Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: See the upgrade log for more details and/or run /usr/sbin/ipa-server-upgrade>
Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: Aborting ipactl
Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br systemd[1]: ipa.service: Main process exited, code=exited, status=1/FAILURE
Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br systemd[1]: ipa.service: Failed with result 'exit-code'.
Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br systemd[1]: Failed to start Identity, Policy, Audit.
If asks for look on /var/log/ipaupgrade.log; but this log is just overwhelming. You must know what you should be looking for for actually find something.
The relevant thing that I’ve found by myself is:
2021-01-06T19:09:51Z DEBUG The ipa-server-upgrade command failed, exception: CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'pki-tomcatd(a)pki-tomcat.service<mailto:pki-tomcatd@pki-tomcat.service>'] returned non-zero exit status 1: 'Job for pki-tomcatd(a)pki-tomcat.service<mailto:pki-tomcatd@pki-tomcat.service> failed because a timeout was exceeded.\nSee "systemctl status pki-tomcatd(a)pki-tomcat.service<mailto:pki-tomcatd@pki-tomcat.service>" and "journalctl -xe" for details.\n’)
Is that Java regression again that happened a month or two ago?
Thank you all.
2 years, 3 months
Setting up authentication for a webserver, part 3: Require ldap-group.
by Simon Matthews
I have got authentication working on my Apache 2.4 webserver, if I require a specific user. However, I would like to require one or more specific groups. I have tried the example given in the documentation:
Require ldap-group
with no group name specified.
I get this result in my log files:
[Wed Jan 12 13:13:52.676003 2022] [authnz_ldap:debug] [pid 23541] mod_authnz_ldap.c(899): [client 10.14.0.18:36914] AH01713: auth_ldap authorize: require group: testing for group membership in ""
[Wed Jan 12 13:13:52.841650 2022] [authnz_ldap:debug] [pid 23541] mod_authnz_ldap.c(926): [client 10.14.0.18:36914] AH01719: auth_ldap authorize: require group "": didn't match with attr Comparison complete [memberOf][53 - Server is unwilling to perform]
[Wed Jan 12 13:13:52.841690 2022] [authnz_ldap:debug] [pid 23541] mod_authnz_ldap.c(943): [client 10.14.0.18:36914] AH01716: auth_ldap authorise: require group "": failed [Comparison complete][53 - Server is unwilling to perform], checking sub-groups
[Wed Jan 12 13:13:52.842761 2022] [authnz_ldap:debug] [pid 23541] mod_authnz_ldap.c(966): [client 10.14.0.18:36914] AH01718: auth_ldap authorise: require group (sub-group) "": didn't match with attr DN failed group verification. [memberOf][53 - Server is unwilling to perform]
I have tried the following in the configuration:
Require ldap-group cn=accounts
Require ldap-group accounts
with AuthLDAPGroupAttributeIsDN set to both "on" and "off". Neither work:
[Wed Jan 12 14:02:47.588735 2022] [authnz_ldap:debug] [pid 7443] mod_authnz_ldap.c(907): [client 10.14.0.18:38342] AH01714: auth_ldap authorize: require group: testing for memberOf: uid=testuser,cn=users,cn=accounts,dc=ipa,dc=bluepearlsoftware,dc=com (cn=accounts)
[Wed Jan 12 14:02:47.753521 2022] [authnz_ldap:debug] [pid 7443] mod_authnz_ldap.c(926): [client 10.14.0.18:38342] AH01719: auth_ldap authorize: require group "cn=accounts": didn't match with attr Comparison complete [memberOf][32 - No such object]
[Wed Jan 12 14:02:47.753562 2022] [authnz_ldap:debug] [pid 7443] mod_authnz_ldap.c(943): [client 10.14.0.18:38342] AH01716: auth_ldap authorise: require group "cn=accounts": failed [Comparison complete][32 - No such object], checking sub-groups
[Wed Jan 12 14:02:47.754391 2022] [authnz_ldap:debug] [pid 7443] mod_authnz_ldap.c(966): [client 10.14.0.18:38342] AH01718: auth_ldap authorise: require group (sub-group) "cn=accounts": didn't match with attr DN failed group verification. [memberOf][32 - No such object]
[Wed Jan 12 14:02:47.754422 2022] [authnz_ldap:debug] [pid 7443] mod_authnz_ldap.c(899): [client 10.14.0.18:38342] AH01713: auth_ldap authorize: require group: testing for group membership in "accounts"
[Wed Jan 12 14:02:47.754426 2022] [authnz_ldap:debug] [pid 7443] mod_authnz_ldap.c(907): [client 10.14.0.18:38342] AH01714: auth_ldap authorize: require group: testing for memberOf: uid=testuser,cn=users,cn=accounts,dc=ipa,dc=bluepearlsoftware,dc=com (accounts)
[Wed Jan 12 14:02:47.764320 2022] [authnz_ldap:debug] [pid 7443] mod_authnz_ldap.c(926): [client 10.14.0.18:38342] AH01719: auth_ldap authorize: require group "accounts": didn't match with attr Comparison complete [memberOf][32 - No such object]
[Wed Jan 12 14:02:47.764358 2022] [authnz_ldap:debug] [pid 7443] mod_authnz_ldap.c(943): [client 10.14.0.18:38342] AH01716: auth_ldap authorise: require group "accounts": failed [Comparison complete][32 - No such object], checking sub-groups
[Wed Jan 12 14:02:47.765169 2022] [authnz_ldap:debug] [pid 7443] mod_authnz_ldap.c(966): [client 10.14.0.18:38342] AH01718: auth_ldap authorise: require group (sub-group) "accounts": didn't match with attr DN failed group verification. [memberOf][32 - No such object]
I would appreciate any help to get this working. I am running on a fully updated CentOS 7 VM.
2 years, 3 months
Invalidate cache for AD groups
by iulian roman
Hello,
I have an IPA setup and AD trust configured. After we removed an OU from AD , on the Linux side the users still show as part of those groups from the OU removed. I run sss_cache -u on both IPA servers and IPA clients, but the issue seems to not be solved.
Any idea how those groups can be invalidated from the IPA cache ?
Thank You !
2 years, 3 months
Invalidate cache for AD groups
by iulian roman
Hello,
I have an IPA setup and AD trust configured. After we removed an OU from AD , on the Linux side the users still show as part of those groups from the OU removed. I run sss_cache -u on both IPA servers and IPA clients, but the issue seems to not be solved.
Any idea how those groups can be invalidated from the IPA cache ?
Thank You !
2 years, 3 months
Setting up authentication for apache webserver (part 2) -- User is not unique
by Simon Matthews
I seem to get two entries every time I create new user. This is causing the webserver authentication to fail with the message about "User is not unique":
[Tue Jan 11 20:42:16.645046 2022] [authnz_ldap:debug] [pid 21005] mod_authnz_ldap.c(505): [client 10.14.0.18:59704] AH01691: auth_ldap authenticate: using URL ldaps://ipa1.sj.bps:636/dc=ipa,dc=bluepearlsoftware,dc=com?uid?sub
[Tue Jan 11 20:42:16.810661 2022] [authnz_ldap:info] [pid 21005] [client 10.14.0.18:59704] AH01695: auth_ldap authenticate: user testuser authentication failed; URI / [User is not unique (search found two or more matches)][No such object]
[Tue Jan 11 20:42:16.810715 2022] [auth_basic:error] [pid 21005] [client 10.14.0.18:59704] AH01618: user testuser not found: /
# ipa user-add testuser
First name: test
Last name: user
---------------------
Added user "testuser"
---------------------
User login: testuser
First name: test
Last name: user
Full name: test user
Display name: test user
Initials: tu
Home directory: /home/testuser
GECOS: test user
Login shell: /bin/sh
Principal name: testuser(a)IPA.BLUEPEARLSOFTWARE.COM
Principal alias: testuser(a)IPA.BLUEPEARLSOFTWARE.COM
Email address: testuser(a)ipa.bluepearlsoftware.com
UID: 1293000017
GID: 1293000017
Password: False
Member of groups: ipausers
Kerberos keys available: False
[root@ipa1 scripts]# ldapsearch '(uid=testuser)'
SASL/GSSAPI authentication started
SASL username: admin(a)IPA.BLUEPEARLSOFTWARE.COM
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <dc=ipa,dc=bluepearlsoftware,dc=com> (default) with scope subtree
# filter: (uid=testuser)
# requesting: ALL
#
# testuser, users, compat, ipa.bluepearlsoftware.com
dn: uid=testuser,cn=users,cn=compat,dc=ipa,dc=bluepearlsoftware,dc=com
objectClass: posixAccount
objectClass: ipaOverrideTarget
objectClass: ipaOverrideTarget
objectClass: top
gecos: test user
cn: test user
uidNumber: 1293000017
gidNumber: 1293000017
loginShell: /bin/sh
homeDirectory: /home/testuser
ipaAnchorUUID:: OklQQTppcGEuYmx1ZXBlYXJsc29mdHdhcmUuY29tOjBlYmM2ZGJlLTczNDgtMT
FlYy1iNWQ5LTUyNTQwMGI1NzZmYg==
uid: testuser
# testuser, users, accounts, ipa.bluepearlsoftware.com
dn: uid=testuser,cn=users,cn=accounts,dc=ipa,dc=bluepearlsoftware,dc=com
displayName: test user
uid: testuser
krbCanonicalName: testuser(a)IPA.BLUEPEARLSOFTWARE.COM
objectClass: top
objectClass: person
objectClass: organizationalperson
objectClass: inetorgperson
objectClass: inetuser
objectClass: posixaccount
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: ipaobject
objectClass: ipasshuser
objectClass: ipaSshGroupOfPubKeys
objectClass: mepOriginEntry
loginShell: /bin/sh
initials: tu
gecos: test user
sn: user
homeDirectory: /home/testuser
mail: testuser(a)ipa.bluepearlsoftware.com
krbPrincipalName: testuser(a)IPA.BLUEPEARLSOFTWARE.COM
givenName: test
cn: test user
ipaUniqueID: 0ebc6dbe-7348-11ec-b5d9-525400b576fb
uidNumber: 1293000017
gidNumber: 1293000017
mepManagedEntry: cn=testuser,cn=groups,cn=accounts,dc=ipa,dc=bluepearlsoftware
,dc=com
memberOf: cn=ipausers,cn=groups,cn=accounts,dc=ipa,dc=bluepearlsoftware,dc=com
# search result
search: 4
result: 0 Success
# numResponses: 3
# numEntries: 2
Relevant part of Apache config file:
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
LoadModule ldap_module modules/mod_ldap.so
LoadModule authz_core_module modules/mod_authz_core.so
LoadModule authn_core_module modules/mod_authn_core.so
Loglevel authnz_ldap_module:debug
LDAPTrustedGlobalCert CA_BASE64 /etc/httpd/certs/ca.crt
<Location />
AuthType Basic
AuthName "Blue Pearl"
AuthBasicProvider ldap
AuthLDAPURL ldaps://ipa1.sj.bps:636/dc=ipa,dc=bluepearlsoftware,dc=com?uid?sub
# AuthLDAPURL ldaps://ipa1.sj.bps:636/dc=ipa,dc=bluepearlsoftware,dc=com
AuthLDAPBindDN uid=httpbind,cn=sysaccounts,cn=etc,dc=ipa,dc=bluepearlsoftware,dc=com
AuthLDAPBindPassword <password for httpbind>
Require ldap-group ipausers
# Require ldap-group
AuthLDAPGroupAttributeIsDN off
</Location>
2 years, 3 months
DNSSEC - File.cpp(94): Could not open the file
by lejeczek
Hi guys
When I sign a zone I get lots of:
...
File.cpp(94): Could not open the file (Permission denied):
/var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/26365760-a70d-19be-2db1-a80adc796477.object
File.cpp(94): Could not open the file (Permission denied):
/var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/9776a26e-2ad9-1b46-b65c-11265eee7fbd.object
File.cpp(94): Could not open the file (Permission denied):
/var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/9776a26e-2ad9-1b46-b65c-11265eee7fbd.object
zone private.road/IN (signed): sending notifies (serial
1642004083)
client @0x7f8f7c1948b8 10.3.1.99#39887: received notify for
zone 'private.road'
Are those a reason to worry & investigate? If not then what
do they translate to?
many thanks, L
2 years, 3 months
Exporting settings from one freeipa domain to a new domain
by Sina Owolabi
Hi List!
And sincere apologies if this has been asked before.
Can I possibly export users, groups, hmac and sudo settings from one
domain to a fresh installation in a wholly new domain?
Source domain is running on CentOS Linux release 7.9.2009, and
ipa-server-common-4.6.8-5.el7,
Destination will be latest on CentOS Stream 8.
Thanks in advance!
--
cordially yours,
Sina Owolabi
2 years, 3 months
DNS forward zone - ? - does not forward
by lejeczek
Hi guys
I have a basic fwd zone:
-> $ ipa dnsforwardzone-show private.lot. --all --rights
dn: idnsname=private.lot.,cn=dns,dc=mine,dc=private
Zone name: private.lot.
Active zone: TRUE
Zone forwarders: 10.3.1.221, 10.3.1.222
Forward policy: only
attributelevelrights: {'objectclass': 'rscwo', 'aci':
'rscwo', 'idnsname': 'rscwo', 'idnszoneactive': 'rscwo',
'idnsforwarders': 'rscwo', 'idnsforwardpolicy': 'rscwo',
'nsaccountlock': 'rscwo'}
objectclass: top, idnsforwardzone
but:
-> $ host c8kubernode2.private.lot
Host c8kubernode2.private.lot not found: 2(SERVFAIL)
and when I'm looking at the forwarded-to server(also IPA) it
does _not_ seem like queries even get to it.
This got me pretty puzzled and only thing gets me suspicious
is - forwarding-from & forwarded-to are on the same IP
subnet and IPA is silently unhappy about it?
What else it can be?
many thanks, L.
2 years, 3 months
