March 2022 - FreeIPA-users - Fedora mailing-lists

DNS - no paypal.com RSASHA1 ?
by lejeczek 24 Mar '22

24 Mar '22

Hi guys. With latest IPA on CentOS 9, ver 4.9.8 & bind-9.16.23-1.el9.x86_64 - what would be a correct (temporary) workaround for those records around the world which are signed with "oldish" crypts? many thanks, L.

4 6

Directory Manager automation
by Jim Kinney 22 Mar '22

22 Mar '22

I have the system set to use CRYPT-SHA512 as password store method. For antiquated reasons I need to generate a shadow file from data stored in freeipa. I would greatly prefer to not have to use the cn=Directory Manager and use a different binddn. But it seems only the DM has the ability to actually retrieve userpasswd. The pain point is the password entry. -y file doesn't work - ldap-bind: Invalid credentials (49). The stored password is correct and perms are 0600 and in /root. The DM is not in the kerberos database so I can't use a keytab and -YGSSAPI. The only method that works is the password entered on the cli. Ugh. That is unpleasant. This needs to run on a systemd timer to autogenerate the shadow file (and passwd and group files but those are easy) for a few thousand nodes that can't fail due to a network outage with freeipa (IdM actually). This is to handle user password changes and group membership changes in an HPC environment. I can dump in the passwd with expect. Just wondering if there's a way to setup a special password hash reading account with a keytab and not use the Directory Manager and password. -- Computers amplify human error Super computers are really cool

3 4

Active Directory Certificate Services as a Subordinate CA under IPA
by Tyrell Jentink 22 Mar '22

22 Mar '22

I am primarily a Linux admin, and this might be a Windows problem... In fact, this might not even be the right forum for me to be asking this question, but I don't know which Windows forum would give me the time of day, so I'm here... I might also try some Windows Reddit groups... :p The following domain names are obscured to protect the wicked; I know not to use fake domains ;) I have an IPA server called dc.domain.local, an ActiveDirectory Directory Server called pdc.win.domain.local, and a ActiveDirectory Certificate Server called pki.win.domain.local. I am trying to configure the ADDS as a subdomain of the IPA domain. I am using A and NS Records to delegate the subdomain name. I am NOT attempting to create a interforest trust between these two domains at this time (Although, as an aside, there will eventually be another IPA server at pdc.lin.rxrhouse.net for subdomain lin.domain.local, and THAT one will have an interforest trust with win.rxrhouse.net; If IPA-IPA Trusts ever become a "thing", the top domain will get trusts to both subdomains, but for now, pki.win.domain.local only needs to 1) have a signed subordinate certificate from dc.domain.local, and 2) run). As I have been able to get it, ADCS seems to be installed with a signed cert, but it won't run. I installed ADCS as an Enterprise Subordinate CA; Based on https://frasertweedale.github.io/blog-redhat/posts/2017-08-14-ad-cs.html, I added win.domain.local as a host principal on IPA. I used that principal to sign the CSR, which worked fine. I installed that certificate back to AD. AD prompted for the Root Certificate, which I provided, and AD warned that it couldn't verify the chain of trust because it couldn't contact a CRL. But now ADCS won't start... Every time I try to start it, it complains, again, that it can't reach a CRL. In Windows Server Manager, in Certificate Authority manager (CertSrv), right click on the CA tree, under Properties... I see that all of the CRL Distribution Points (CDPs) and AIAs are their default, non-configured forms... It's my crude guess that I need to be pointing those values to IPA? The example is of the form http://<ServerDNSName>/CertEnroll/<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl, if that hint prompts anyone's thinking... Even if you have a suggestion of another forum to ask this on, I'm all ears. Thank you for your assistance! -- Tyrell Jentink

2 3

sudo rules and globbing
by Djerk Geurts 22 Mar '22

22 Mar '22

This is a topic that I've spent way too much time on recently. The reason is I'm trying to manage sudo rights for teams and the sudo ruleset is getting out of hand as no globs I've tried are working except for maybe an '*' in a pathname. I'm trying to keep things secure I'd like to allow members of a certain group to manage the services they're responsible for. These are dev guys so there's a fair bit of management involved. Initially, I would create a rule for systemctl start, another for stop, etc for status, reload and restart. Then I have to add the journalctl rules for seeing the current logs and the tail options for those. In trying to make thing easier when adding rules, and knowing glob should be supported I was hoping to simplify things to: /usr/bin/journalctl --unit nodejs@+([a-zA-Z]) @(-t) /usr/bin/systemctl (start|stop|status|reload|restart) nodejs@+([a-zA-Z]) But alas, none of this is working, what does work is a long list of rules specific to each separate instantiated service, which is getting really tiresome and error-prone. Is there anything I can do to ease maintaining these rules, or do I give up and look at using Ansible to automate FreeIPA sudo rules?

4 4

Re: sudo rules and globbing
by Djerk Geurts 22 Mar '22

22 Mar '22

Hi Angus, I’ve seen the suggestion, but the issue with that would be having to train people on different commands, and me having to write custom scripts. I’m trying avoid further customisation, instead training people how to use systems rather than run services under personal accounts or needlessly as root. It’s a tough call to then turn around and say that it’s okay to run my custom script because there’s no centralised way of managing things. See these scripts would then also need to be deployed to these systems and maintained. When I issue 'sudo -l’ I see the rules parsed as configured in FreeIPA, which confirms Rob’s point of how the rules are read by sudo. I’m going to have a go at creating some local rules to see if I can use wildcards there. Failing that it’ll be a CI/CD workflow to deploy a shudders file to /etc/sudoers.d/ And then reference the Cmnd_Alias in a FreeIPA rule. All stuff that introduces more potential issues, but both alternatives are too extreme (my time, versus a complete lack of security). Thanks, Djerk > On 22 Mar 2022, at 16:45, Angus Clarke <angus(a)charworth.com> wrote: > > Hi Djerk > > Alternatively, you could write/deploy wrapper scripts to run the commands you want. > > Regards > Angus > > From: Djerk Geurts via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> > > > On 22 Mar 2022, at 15:42, Rob Crittenden <rcritten(a)redhat.com> wrote: > > > > Djerk Geurts via FreeIPA-users wrote: > >> This is a topic that I've spent way too much time on recently. The reason is I'm trying to manage sudo rights for teams and the sudo ruleset is getting out of hand as no globs I've tried are working except for maybe an '*' in a pathname. I'm trying to keep things secure I'd like to allow members of a certain group to manage the services they're responsible for. These are dev guys so there's a fair bit of management involved. > >> > >> Initially, I would create a rule for systemctl start, another for stop, etc for status, reload and restart. Then I have to add the journalctl rules for seeing the current logs and the tail options for those. > >> > >> In trying to make thing easier when adding rules, and knowing glob should be supported I was hoping to simplify things to: > >> > >> /usr/bin/journalctl --unit nodejs@+([a-zA-Z]) @(-t) > >> /usr/bin/systemctl (start|stop|status|reload|restart) nodejs@+([a-zA-Z]) > >> > >> But alas, none of this is working, what does work is a long list of rules specific to each separate instantiated service, which is getting really tiresome and error-prone. Is there anything I can do to ease maintaining these rules, or do I give up and look at using Ansible to automate FreeIPA sudo rules? > > > > It may very well depend on the version of sudo you have on the client(s) > > whether regular expressions are supported or not. > > > > IPA is only a container for the rules. It just passes them along to > > sudo. I'd suggest checking with the sudo team as well. > > > > There may also be distribution-based idiosyncrasies. > > > > rob > > Thanks you, I’ll check there as well. It’s mostly Ubuntu 20.04 here with a few Debian 10 and CentOS 7 machines as well. So far I’ve seen no difference between them. > > Djerk

1 0

PacRequestorEnforcement and CVE-2021-42287, any concern?
by Amos 21 Mar '22

21 Mar '22

Hi. I'm trying to find out if the changes to PacRequestorEnforcement in order to remedy CVE-2021-42287 will have an impact on IPA servers/clients. Our IPA servers are in a one-way trust with AD. All user accounts are in AD. I've tried to lookup anything related to this, but not finding much. When I opened a ticket with Redhat, they just referred to https://access.redhat.com/solutions/6633491 which isn't very encouraging. Amos

2 2

Help request on FreeIPA and Linux Certicate of Authority renewal.
by Eric Boisvert 18 Mar '22

18 Mar '22

Hi, We are looking for help on CA certificate renewal with FreeIPA under a Linux environment. We went through most of the FreeIPA documentation available and we couldnt fix our issue yet. Is there an expert on this topic that could help us with this issue. Best Regards, Eric Boisvert Directeur des Opérations/Operation Manager LR Tech inc. 3945 Boul. Guillaume-Couture Lévis (Québec) G6W 1H6 Canada Tél: (418) 907-1661 Mobile: (581) 309-9279 <http://www.lrtech.ca/> www.lrtech.ca ____________________________________________________________________________ ____________________________________________________________________________ __ Ce courriel (de même que les fichiers joints) est strictement réservé à l'usage de la personne ou de l'entité à qui il est adressé et peut contenir de l'information privilégiée et confidentielle. Toute divulgation, distribution ou copie de ce courriel est strictement prohibée. Si vous avez reçu ce courriel par erreur, veuillez nous en aviser sur-le-champ, détruire toutes les copies et le supprimer de votre système informatique.

3 30

Right intermediate CA path
by sodd＠email.cz 18 Mar '22

18 Mar '22

Hi, first i would like to thank you all for your great work on FreeIPA! I'm having problem with how FreeIPA (installed with external CA) is creating CA chain in wrong order (if I'm not wrong) according to RFC 5280 section 6.1. [1]. When I try to use /etc/ipa/ca.crt in 3th party web app the app wont start until i fix the chain order. So my questing is how to fix this wrong chain order gerenrated from ipa- certupdate. PS: I created test instance and made self sign CA and then intermediated CAs to show how will FreeIPA construct the chain. And for this chain: ROOTCA <- INTERCA-B <- INTERCA-C <- INTERCA-D <- INTERCA-E <- INTERCA-IPA FreeIPA ipa-certupdate create this chain: 0: subject=CN = INTERCA-B issuer=CN = ROOTCA 1: subject=CN = INTERCA-C issuer=CN = INTERCA-B 2: subject=CN = INTERCA-D issuer=CN = INTERCA-C 3: subject=CN = INTERCA-E issuer=CN = INTERCA-D 4: subject=CN = ROOTCA issuer=CN = ROOTCA 5: subject=CN = INTERCA-IPA issuer=CN = INTERCA-E Right order should be: 0: subject=CN = INTERCA-IPA issuer=CN = INTERCA-E 1: subject=CN = INTERCA-E issuer=CN = INTERCA-D 2: subject=CN = INTERCA-D issuer=CN = INTERCA-C 3: subject=CN = INTERCA-C issuer=CN = INTERCA-B 4: subject=CN = INTERCA-B issuer=CN = ROOTCA 5: subject=CN = ROOTCA issuer=CN = ROOTCA Is there anything what I can do to fix this situation. Right now I'm handling this situation with ipa-getcert request --after-command. [1] - https://datatracker.ietf.org/doc/html/rfc5280#section-6.1 -- sodd(a)email.cz

1 0

Add custom subentry to UID object.
by Jean Tomaz da Silva 17 Mar '22

17 Mar '22

Dears, Is it possible to add a custom subentry to UID object without using the ldapmodifty tool? Using the ipa cli commands or through of the web ui. My ldif file content is bellow. dn: Affiliation=1,uid=john,cn=users,cn=accounts,dc=example,dc=com changetype: add Affiliation: 1 AffiliationType: employee objectClass: CustomPerson objectClass: top Best regards, Jean Tomaz

3 8

IPA AD Authentication not successfull if using alernative logon domain
by Florian Wilhelm 17 Mar '22

17 Mar '22

We are successfully running a FreeIPA setup connected to an AD using kerberos to authenticate. (IPA is used as provider). Our windows domain name is not identical to our main mail domain. For some users the User logon name in windows (the one with @ not the old pre-win2000 one) is using a domain name which has no kerberos servers etc. In windows authentication works perfectly, but in our IPA setup we run into a big issue. No matter which domain the user chooses to authenticate against our linux servers, the linux server tries to authenticate against the kerberos servers of the domain which has no servers. In the krb5.conf we manually configured the kerberos servers of the windows AD for this domain. Now we get [Realm not local to KDC] in the krb5_child.log. Is there any way to forcefully replace the domain name when authenticating? We tried using auth_to_local without success so far.

3 3

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2022