FreeIPA-users March 2023

freeipa-users@lists.fedorahosted.org

31 participants
56 discussions

Re: Creating and modifying users from an external system
by Rob Crittenden 24 Mar '23

24 Mar '23

Ronald Wimmer wrote: > On 20.03.23 13:44, Rob Crittenden wrote: >> Ronald Wimmer via FreeIPA-users wrote: >>> We have several scenarios where we cannot establish an AD Trust. In >>> these cases we are forced to create/modify/delete IPA users triggered >>> from an IAM system. Is the IPA API the one and only way to go or would >>> it also work if we used IPA's LDAP directly? >> >> Using the stageuser and user API is recommended. It's certainly possible >> to do it directly in LDAP but we don't encourage it. It requires >> knowledge of how the entry is structured, what gets added automatically, >> etc. We also can't guarantee that there won't be changes to the >> objectclasses, etc. that would break any direct LDAP comms. > > Apart from the obvious, what will be created when upon user creation? Is > there something we would most likly not think of? > > In the IPA WebGUI it looks like that a user's UID and GID could be > chosen freely? That would be perfect I we want to match a user's UID > with another system... This is why we recommend stageusers so you don't have to worry about such things. See https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… rob

1 0

Healthcheck for IPATrustCatalog contradicts ipa trust-show - false positive?
by Jeremy Tourville 24 Mar '23

24 Mar '23

Question: Why are these healthcheck issues present? IPA03 can run a trust show and the Domain Security Identifier matches the kw key. Should the uuid be the same or different between IPA02 and IPA03? Scenario: 3 IPA servers Replication pattern: 1 -> 2 & 3 2 -> 1 & 3 3 -> 1 & 2 All servers are: AD trust agent AD trust controller CA server DNS server health check on IPA01 is completely healthy [root@gsil-ipa03 ~]# ipa-healthcheck --failures-only CN=GSIL-CA,DC=gsil,DC=smil not found, assuming 3rd party [ { "source": "ipahealthcheck.ipa.trust", "check": "IPATrustDomainsCheck", "result": "WARNING", "uuid": "82ff4156-efd4-4bab-a092-ce5d5736c7e8", "when": "20230324133158Z", "duration": "0.235919", "kw": { "key": "domain-status", "domain": "gsil.x", "msg": "Domain {domain} is not online" } }, { "source": "ipahealthcheck.ipa.trust", "check": "IPATrustCatalogCheck", "result": "WARNING", "uuid": "c8a1bebe-fd44-4ea6-8d98-f20ad6726d00", "when": "20230324133158Z",Domain Security Identifier "duration": "0.008165", "kw": { "key": "S-1-5-21-3568498085-2952124370-1649233135", "error": "returned nothing", "msg": "Look up of {key} {error}" } }, { "source": "ipahealthcheck.ipa.trust", "check": "IPATrustCatalogCheck", "result": "ERROR", "uuid": "c0aed85c-9c0a-42df-83ab-d69b4bc054a5", "when": "20230324133158Z", "duration": "0.114333", "kw": { "key": "AD Global Catalog", "output": "Active servers:\nIPA: gsil-ipa03.idm.x.x", "sssctl": "/usr/sbin/sssctl", "domain": "gsil.x", "msg": "{key} not found in {sssctl} 'domain-status' output: {output}" } }, { "source": "ipahealthcheck.ipa.trust", "check": "IPATrustCatalogCheck", "result": "ERROR", "uuid": "6542b352-88ae-4524-ba76-94960adfe9a7", "when": "20230324133158Z", "duration": "0.114378", "kw": { "key": "AD Domain Controller", "output": "Active servers:\nIPA: gsil-ipa03.idm.x.x", "sssctl": "/usr/sbin/sssctl", "domain": "gsil.x", "msg": "{key} not found in {sssctl} 'domain-status' output: {output}" } } ] [root@gsil-ipa03 ~]# ipa trust-show Realm name: gsil.x Realm name: gsil.x Domain NetBIOS name: GSIL Domain Security Identifier: S-1-5-21-3568498085-2952124370-1649233135 Trust direction: Trusting forest Trust type: Active Directory domain [root@gsil-ipa02 ~]# ipa-healthcheck --failures-only caSigningCert External CA not found, assuming 3rd party [ { "source": "ipahealthcheck.ipa.trust", "check": "IPATrustDomainsCheck", "result": "WARNING", "uuid": "319ec55d-6d71-48fa-bb80-4ab5acb9a62b", "when": "20230324133810Z", "duration": "0.281341", "kw": { "key": "domain-status", "domain": "gsil.x", "msg": "Domain {domain} is not online" } } ]

2 1

Check ticket expiration for all users
by Francis Augusto Medeiros-Logeay 23 Mar '23

23 Mar '23

Hi, We use RHEL 8 with kerberos, and we are using NFSv4 for mounting home directories. We have experienced that some machines become unresponsive if a user has a job that writes to the home directory after his ticket has expired after the default lifetime (7 days in our case). While we are looking for ways to allow people to automatically get new tickets, we also want to have a mechanism to log users out if their tickets are too close expiration (as well as all their jobs and cron jobs). Is there a way to get the expiration date for user tickets for a given user with for example “klist", or only the user himself can get that info? Best, Francis

2 4

Replica Server can not join to master server
by Can Chang 23 Mar '23

23 Mar '23

Old Replica Server Faild, so rebuild new replica server, when success join to master us ipa-client-install with --force-join, run ipa-replica-install, on "Configuring directory server (dirsrv). Estimated time: 30 seconds" step [27/42]: creating DS keytab, has error. [error] CalledProcessErroe: Command '/usr/sbin/ipa-getkeytab -k /etc/firsrv/ds.keytab -p ldap/aaaa.ipa.bbbb.cccc.dddd(a)IPA.BBBB.CCCC.DDDD -H ldaps://xxxx.ipa.bbbb.cccc.dddd' returned non-zero exit status 9 who to fix this problem? This replica server is fresh install. Thanks

1 0

Migrate HBAC, sudo rules, users, groups and all of them to new IPA server
by Bryan Fang 21 Mar '23

21 Mar '23

Hi folks, As previous thread https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… mentioned, and now it's 2023, I want to check if we can migrate all FreeIPA resource from existing server to new server? actually I can use ipa migrate-ds to migrate users and groups, however still need a way to migrate other components, please share your ideas about this requirement, thanks a lot! Best regards Bryan

2 4

Changing userPassword attribute on a plugin
by Francis Augusto Medeiros-Logeay 21 Mar '23

21 Mar '23

Hi, I am developing a plugin for FreeIPA (mostly to handle Postfix and virtual mailboxes/domains). The thing is that I created an objectClass (postfixMailbox), where the user has the following attributes: - mail - userPassword - mailQuota - active I don’t know what are the requirements for the user to be able to choose his own password by logging into FreeIPA’s gui. What I did was to add the inetOrgPerson and inetUser objectClasses, just to see if the user would be allowed to log in for changing password-purposes. Still no go. These users are in a totally different container (every virtual domain is a container). I also am not sure if I want these users to be like a normal user, but at the same time I want to be able to change their password. Any tips on how to achieve something like this, besides using a command-line plugin? Best, Francis

2 2

Need assistance to troubleshoot named not starting
by Jeremy Tourville 21 Mar '23

21 Mar '23

This problem started when someone deleted my /etc/krb5.keytab file. I am trying to get the named service working again. I am following the docs: What to do when named with bind-dyndb-ldap cannot start https://docs.pagure.org/bind-dyndb-ldap/BIND9/NamedCannotStart.html 1 Gather logs- A. my system is Rocky 8.7 and does not contain /var/log/messages. Really! I was surprised too and wondering why not. I thought that was a standard log that all EL systems had. B /var/named/data/named.run is a file with zero size. Yes, it's unfortunately empty. >>>What did you change before it started to fail? :-) /etc/krb5.keytab was deleted. See post - https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos… 2. >>>Server ldap/srv01(a)EXAMPLE.COM not found in Kerberos database This is not an issue. hostname displays FQDN and /etc/hosts is correctly formatted as shown in the correct line example 3>>>Failed to init credentials or Failed to get initial credentials This is not an issue for /etc/named.keytab, the version of klist and kvno match HOWEVER, /etc/krb5.keytab does not match when running klist and kvno Could this have the same effect? To cause named not to start? Should I continue down the list and also get some more info from setting up the trace export KRB5_TRACE=/tmp/named_krb5.log or fix the issue with /etc/krb5.keytab first? At this point I think I will stop investigating until I get a more clear understanding of my questions. I hope someone can assist. Many thanks in advance!

1 1

keytab file deleted and sssd not starting
by Jeremy Tourville 21 Mar '23

21 Mar '23

I don't know how but somehow /etc/krb5.keytab was deleted on my ipa server. As a result my sssd service is dead because the keytab file is missing I understand the process to fix this is: 1. kinit admin and provide the password 2. ipa-getkeytab -s <FreeIPA server> -p host/<hostname>@REALM -k <keytab file>. if command #2 is successful you should get a keytab file and you can run systemctl restart sssd and all will be happy again. My problem is that when running command #2 I get an error if I specify -p host/ for the service prinicpal. SASL bind failed invalid credentials failed to bind to server Retrying with pre-4.0 keytab retrieval method... If I specify -p ldap/ I can get it to complete and a keytab gets generated. As a side note I have a bunch of ipa-healthcheck erors but maybe those are mostly related to the fact that sssd is not running and keytab is missing. The affected server is my primary but I do have a replica that is in good heatlh except for one healthcheck issue for dns. Both servers contain the following roles: AD trust agent AD trust controller CA server DNS server The IPA server also has a one way trust established with AD. What is the correct principal to specify? Is it host or ldap or dns or something else?

3 9

Using "reserved" addresses inj Freeipa (200::/7)
by Dirk Gottschalk 21 Mar '23

21 Mar '23

Hello, we want to use FreeIPA inside of a Yggdrasil-Network which uses the 0200::/7 address space. FreeIPA refuses to work with this addresses because it detects them as IANA reserved address space. Is there any way to override this behaviour and make it work in this address space? Kind Regards, Dirk

2 1

Authentication Kept Failing When SSHing to IPA Clients With The Right Password
by Loi Do 21 Mar '23

21 Mar '23

WHAT HAPPENED: Hello all, I recently re-deployed FreeIPA server & clients due to an issue where an IPA created user wasn't able to SSH into their home directory (permission denied). There were several solutions that mentioned to run "authselect enable-feature with-mkhomedir" or "sudo authconfig --enablemkhomedir --update". At the time, none of these worked because a) authselect wasn't available on my system and I didn't think to install it b) authconfig was available but didn't work. ISSUE: I decided to redeploy the entire freeIPA deployment with "sudo ipa-server-install/ipa-client-install --mkhomedir" and now I can't authenticate to IPA clients with an IPA created user. I wasn't able to authenticate to the IPA server either until I spin up a new VM and reinstalled it. As of now, I have an IPA server (vipa.homelab.internal - 192.168.254.198) and client (vpdns.homelab.internal - 192.168.254.33). I can authenticate the user "ldo" to vipa.homelab.internal via SSH but unable to do so for vpdns.homelab.internal. RELATED THREAD: I stumbled upon some old threads with users facing a similar issue but they weren't getting anywhere. 1. https://listman.redhat.com/archives/freeipa-users/2014-December/msg00197.ht… 2. https://listman.redhat.com/archives/freeipa-users/2015-March/015895.html 3. https://listman.redhat.com/archives/freeipa-users/2015-March/016247.html I believe the 1st link is the issue I might have (SSSD/PAM is somehow misconfigured). Others have pointed out that "sudo ipa-client-install/ipa-server-install --uninstall" is not a clean process which I believe might have caused some misconfiguration. I'm not familiar with SSSD/PAM on how they should be configured. I'm hoping this is where I can get help on. Below are my SSH logs and /var/log/secure from vpdns.homelab.internal SSH LOGS [ldo@vipa ~]$ ssh -v ldo(a)vpdns.homelab.internal OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 62: Applying options for * debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 22 vpdns.homelab.internal debug1: permanently_drop_suid: 1860400001 debug1: key_load_public: No such file or directory debug1: identity file /home/ldo/.ssh/id_rsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/ldo/.ssh/id_rsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/ldo/.ssh/id_dsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/ldo/.ssh/id_dsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/ldo/.ssh/id_ecdsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/ldo/.ssh/id_ecdsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/ldo/.ssh/id_ed25519 type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/ldo/.ssh/id_ed25519-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_7.4 debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4 debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000 debug1: Authenticating to vpdns.homelab.internal:22 as 'ldo' debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: algorithm: curve25519-sha256 debug1: kex: host key algorithm: ecdsa-sha2-nistp256 debug1: kex: server->client cipher: chacha20-poly1305(a)openssh.com MAC: <implicit> compression: none debug1: kex: client->server cipher: chacha20-poly1305(a)openssh.com MAC: <implicit> compression: none debug1: kex: curve25519-sha256 need=64 dh_need=64 debug1: kex: curve25519-sha256 need=64 dh_need=64 debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ecdsa-sha2-nistp256 SHA256:CmN1AtdcdqAbPxZNE8lEdpZSVOsBlzhel9cfHwS3j9M debug1: Host 'vpdns.homelab.internal' is known and matches the ECDSA host key. debug1: Found key in /home/ldo/.ssh/known_hosts:1 debug1: rekey after 134217728 blocks debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: rekey after 134217728 blocks debug1: SSH2_MSG_EXT_INFO received debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512> debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive debug1: Next authentication method: gssapi-keyex debug1: No valid Key exchange context debug1: Next authentication method: gssapi-with-mic debug1: Unspecified GSS failure. Minor code may provide more information Server host/vpdns.homelab.internal(a)HOMELAB.INTERNAL not found in Kerberos database debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive debug1: Next authentication method: publickey debug1: Trying private key: /home/ldo/.ssh/id_rsa debug1: Trying private key: /home/ldo/.ssh/id_dsa debug1: Trying private key: /home/ldo/.ssh/id_ecdsa debug1: Trying private key: /home/ldo/.ssh/id_ed25519 debug1: Next authentication method: keyboard-interactive Password: debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive Password: debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive Password: debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive debug1: Next authentication method: password ldo(a)vpdns.homelab.internal's password: debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive Permission denied, please try again. ldo(a)vpdns.homelab.internal's password: debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive Permission denied, please try again. ldo(a)vpdns.homelab.internal's password: Received disconnect from UNKNOWN port 65535:2: Too many authentication failures Authentication failed. /var/log/secure Mar 20 15:24:39 vpdns sshd[9511]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.254.198 user=ldo Mar 20 15:24:39 vpdns sshd[9511]: pam_sss(sshd:auth): received for user ldo: 7 (Authentication failure) Mar 20 15:24:42 vpdns sshd[9509]: error: PAM: Authentication failure for ldo from 192.168.254.198 Mar 20 15:24:45 vpdns sshd[9514]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.254.198 user=ldo Mar 20 15:24:45 vpdns sshd[9514]: pam_sss(sshd:auth): received for user ldo: 7 (Authentication failure) Mar 20 15:24:47 vpdns sshd[9509]: error: PAM: Authentication failure for ldo from 192.168.254.198 Please let me know if I need to provide any additional information or logs. Do kindly specify where I can get them as well since I'm just starting out in Linux and FreeIPA. Thank you all in advance.

2 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2023