February 2022 - FreeIPA-users - Fedora mailing-lists

Freeipa and server SFTP
by MERCIER Jonathan 16 Feb '22

16 Feb '22

Dear Dev team and community, I created a PAM file in order to authenticate user through vstpd service I would like to get your recommendation Thanks for your insight -------------------------------------- #%PAM-1.0 auth sufficient pam_sss.so forward_pass auth required pam_env.so auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed auth required pam_shells.so auth include password-auth account [default=bad success=ok user_unknown=ignore authinfo_unavail=ignore] pam_sss.so account include password-auth session required pam_loginuid.so session optional pam_keyinit.so force revoke session required pam_mkhomedir.so umask=0022 session required pam_loginuid.so session include password-auth

1 0

renew op produces cert with CN=localhost
by Leo Galambos 16 Feb '22

16 Feb '22

Hello, our FreeIPA was running with correct certificates for 2 years (subject "CN=ipa.hq.company,O=HQ.COMPANY"). Unfortunately, the new certificates (ocspSigningCert, auditSigningCert) were recreated with simple "CN=localhost" (automatically), i.e. the original value "CN=ipa.hq.company,O=HQ.COMPANY" was ignored by certmonger. If you have some knowledge of the FreeIPA internals - can you point me to the right direction, so that I could debug and/or fix this rotation bug, please? Thank you, LG certmonger-0.79.13-3.el8.x86_64 ipa-server-4.9.6-10.module+el8.5.0+13587+92118e57.x86_64 # getcert list Request ID '20200324213127': status: MONITORING stuck: no : CA: IPA issuer: CN=Certificate Authority,O=HQ.COMPANY subject: CN=ipa.hq.company,O=HQ.COMPANY expires: 2022-03-25 22:31:28 CET principal name: krbtgt/HQ.COMPANY(a)HQ.COMPANY key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes Request ID '20210120221127': status: MONITORING stuck: no : CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=HQ.COMPANY subject: CN=localhost expires: 2024-02-04 22:29:37 CET key usage: digitalSignature,nonRepudiation profile: caSignedLogCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20210120221129': status: MONITORING stuck: no : CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=HQ.COMPANY subject: CN=localhost expires: 2024-02-04 22:28:36 CET eku: id-kp-OCSPSigning profile: caOCSPCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes <snip>

2 4

No memberof attribute for external users
by Ruslan Valikhanov 16 Feb '22

16 Feb '22

I cannot get memberof attribute for external users from one-way trust with AD. I have an external group ad_grafana_external with users adtest(a)adtest.local and adtest2(a)adtest.local from AD. This group is a member of group ad_grafana: ldapsearch -W -D "uid=admin,cn=users,cn=accounts,dc=mytest,dc=local" '(cn=ad_grafana)' | grep member member: cn=ad_grafana_external,cn=groups,cn=accounts,dc=mytest,dc=local I can see that AD users are members of ad_grafana group: getent group ad_grafana ad_grafana:*:105800310:adtest2@adtest.local,adtest@adtest.local But I cannot get memberof attribute for this external users: # ldapsearch -W -D "uid=admin,cn=users,cn=accounts,dc=mytest,dc=local" '(uid=adtest2(a)adtest.local)' # extended LDIF # # LDAPv3 # base <dc=mytest,dc=local> (default) with scope subtree # filter: (uid=adtest2(a)adtest.local) # requesting: ALL # # adtest2(a)adtest.local, users, compat, m.mcs.im dn: uid=adtest2(a)adtest.local,cn=users,cn=compat,dc=mytest,dc=local objectClass: posixAccount objectClass: ipaOverrideTarget objectClass: top gecos: adtest2 adtest2 cn: adtest2 adtest2 uidNumber: 140601109 gidNumber: 140601109 homeDirectory: /home/adtest.local/adtest2 ipaAnchorUUID:: OlNJRDpTLTEtNS0yMS0yNjExMDg4Ny0yODU2MDIzNTY0LTI5MTIyOTUzNjYtMT EwOQ== uid: adtest2(a)adtest.local # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Is it possible to add memberof attrubutes to external users? This is needed to authenticate them in web applications such as Grafana and Gitlab in my case. FreeIPA version: 4.6.8-5 OS: CentOS Linux release 7.7.1908 (Core)

2 1

Re: ipa with duo
by John Desantis 14 Feb '22

14 Feb '22

Charles, > Our campus uses DUO. We're wondering whether it's possible to use that from IPA. My main concern is that user interaction can take time. Yes, it is possible and we currently utilize DUO on restricted systems. Our IPA domain consists of an AD Trust (bulk of users) and IDM-only users. HTH, John DeSantis Il giorno ven 11 feb 2022 alle ore 12:40 Charles Hedrick via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> ha scritto: > > Our campus uses DUO. We're wondering whether it's possible to use that from IPA. My main concern is that user interaction can take time. > > I see that it's possible to raise the timeout. But is that safe to do? I'm wondering whether otpd is really designed to have lots of threads waiting for the user to respond. > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

1 0

FreeIPA and AIX
by Ronald Wimmer 14 Feb '22

14 Feb '22

I was wondering if one can configure AIX in a way that trusted AD domain users can be used to log in under AIX. We followed https://www.freeipa.org/page/ConfiguringUnixClients but this guide seems to be LDAP-only and AD users do not have a represenntation in FreeIPA's LDAP directory. Could someone please clarify if AD users could work or not? Cheers, Ronald

3 2

How to disallow ldap query without authentication ?
by MERCIER Jonathan 14 Feb '22

14 Feb '22

Dear FreeIPA community and Dev Team, We have installed some month ago freeipa throw ansible collection/role, and I see that we can query the LDAP to get registered user. For us it is a medium issue, I would like to know, how to allow LDAP query only through an authentication. Did you have a wiki or a documentation for this ? Thanks a lot Best regards

3 4

ipa with duo
by Charles Hedrick 11 Feb '22

11 Feb '22

Our campus uses DUO. We're wondering whether it's possible to use that from IPA. My main concern is that user interaction can take time. I see that it's possible to raise the timeout. But is that safe to do? I'm wondering whether otpd is really designed to have lots of threads waiting for the user to respond.

1 0

Use FreeIPA as a CA for web apps
by Peter Taylor 11 Feb '22

11 Feb '22

Hi all The docs aren't 100% clear on this, how do I use the WebUI to sign a tls cert with the CA I've tried adding via Authentication > Certificates > Certificates but it said it can't find the principal, and when I tick the add principal button, it says i cannot create a user principal I have already added the domain name in Identity > Hosts, but this appears not to change anything Any help would be greatly appreciated Many Thanks

2 1

Increasing SSSD primary-master reconnection interval
by Bill M 11 Feb '22

11 Feb '22

Hi there, I've a primary and three secondary servers in the sssd.conf on my IPA clients. The failover works as expected, and from the logs I can see the client attempting to reconnect to the primary server every 5 minutes. ipa_server = host1-ipa1 ipa_backup_server = host2-ipa1, host3-ipa1, host4-ipa1 Is there an option in sssd.conf to increase this 5 minute interval? So in case host1 and host2 are down, and current active server is host3, I'd like the sssd client to attempt a reconnect to the primary server (host1) every 15-20 minutes. have a good day, thanks.

2 2

Adding DNS on a replica
by Simon Matthews 10 Feb '22

10 Feb '22

I set up a replica server, but I omitted the "--setup-dns" option when installing the replica. Is there any way to add this, without uninstalling completely and re-installing?

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2022