June 2023 - FreeIPA-users - Fedora mailing-lists

Problem joining a windows pc to freeipa realm without an AD server
by fujisan 26 Jun '23

26 Jun '23

Hello everyone, Since I upgraded our server to Fedora 38, we cannot access samba shares on that Linux server from windows pc. So i'm trying now to log in to a windows pc using a freeipa user account. I followed instructions I found in the following documentations: https://freeipa.org/page/Windows_authentication_against_FreeIPA https://computingforgeeks.com/join-windows-system-to-freeipa-realm/ https://www.rootusers.com/how-to-login-to-windows-with-a-freeipa-account/#:… . https://www.server-world.info/en/note?os=CentOS_7&p=ipa&f=8 Basically, I added the windows PC (winpc) in the freeipa host list using the web UI then $ ipa-getkeytab -s server.domain.local -p host/winpc.domain.local(a)DOMAIN.LOCAL -e aes256-cts,aes128-cts,aes256-sha2,aes128-sha2,camellia256-cts-cmac,camellia128-cts-cmac -k /etc/krb5.keytab -P and in a terminal on the windows PC: > ksetup /setdomain DOMAIN.LOCAL > ksetup /addkdc DOMAIN.LOCAL server.domain.local > ksetup /addkpasswd DOMAIN.LOCAL server.domain.local > ksetup /setcomputerpassword p4$$w0rD > ksetup /mapuser * * I also created a local user 'smith' on the windows PC which also exists on the freeipa server: $ ipa user-show smith User login: smith First name: John Last name: Smith Home directory: /home/smith Login shell: /usr/bin/zsh Principal name: smith(a)DOMAIN.LOCAL Principal alias: smith(a)DOMAIN.LOCAL Email address: smith(a)DOMAIN.LOCAL UID: 1010 GID: 1025 SMB Home Directory Drive: A: Account disabled: False Password: True Member of groups: admins, ipausers, trust admins, editors Roles: helpdesk, User Administrator, Enrollment Administrator, Security Architect, IT Security Specialist, FleetCommander Desktop Profile Administrators, IT Specialist Kerberos keys available: True But everytime I try to login with smith(a)DOMAIN.LOCAL and freeipa password of that user, I get the following message: "We could not connect you with these credentials because your domain was not available. ..." and when I check the logs in krb5dc.log Jun 26 09:14:12 server.domain.local krb5kdc[75284](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23), DEPRECATED:arcfour-hmac-exp(24), UNSUPPORTED:(-135), UNSUPPORTED:des-cbc-md5(3)}) 10.0.21.204: NEEDED_PREAUTH: smith(a)DOMAIN.LOCAL for krbtgt/DOMAIN.LOCAL(a)DOMAIN.LOCAL, Additional pre-authentication required Jun 26 09:14:12 server.domain.local krb5kdc[75292](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23), DEPRECATED:arcfour-hmac-exp(24), UNSUPPORTED:(-135), UNSUPPORTED:des-cbc-md5(3)}) 10.0.21.204: ISSUE: authtime 1687763652, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, smith(a)DOMAIN.LOCAL for krbtgt/DOMAIN.LOCAL(a)DOMAIN.LOCAL Jun 26 09:14:12 server.domain.local krb5kdc[4979](info): TGS_REQ (5 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23), DEPRECATED:arcfour-hmac-exp(24), UNSUPPORTED:(-135)}) 10.0.21.204: ISSUE: authtime 1687763652, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, smith(a)DOMAIN.LOCAL for host/winpc.domain.local(a)DOMAIN.LOCAL Also I don't know if this is related to the login problem, but when i reboot the windows pc, i get in the same log file a message saying 'Client not found in Kerberos database.' Jun 26 09:13:49 server.domain.local krb5kdc[75284](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23), DEPRECATED:arcfour-hmac-exp(24), UNSUPPORTED:(-135), UNSUPPORTED:des-cbc-md5(3)}) 10.0.21.204: CLIENT_NOT_FOUND: winpc$(a)DOMAIN.LOCAL for krbtgt/DOMAIN.LOCAL(a)DOMAIN.LOCAL, Client not foundin Kerberos database Jun 26 09:13:49 server.domain.local krb5kdc[75284](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23), DEPRECATED:arcfour-hmac-exp(24), UNSUPPORTED:(-135), UNSUPPORTED:des-cbc-md5(3)}) 10.0.21.204: CLIENT_NOT_FOUND: winpc$(a)DOMAIN.LOCAL for krbtgt/DOMAIN.LOCAL(a)DOMAIN.LOCAL, Client not foundin Kerberos database So what am I missing? Best regards F.

1 0

[SSSD] Announcing SSSD 2.9.1
by Pavel Březina 23 Jun '23

23 Jun '23

# SSSD 2.9.1 The SSSD team is announcing the release of version 2.9.1 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.1 See the full release notes at: https://sssd.io/release-notes/sssd-2.9.1.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### New features * Passkey: added option to write key mapping data to file. ### Important fixes * A regression was fixed that prevented autofs lookups to function correctly when cache_first is set to True. Since this was set as a new default value in sssd-2.9.1, it is considered as a regression. * A regression where SSSD failed to properly watch for changes in '/etc/resolv.conf' when it was a symbolic link or was a relative path, was fixed.

1 0

Migrating from Rhel 7 to Rhel 9 (changing UID/GID_MAX and losing admins group)
by Finn Fysj 22 Jun '23

22 Jun '23

Hi, When I try to migrate from my RHEL 7 instance RHEL 9 most of the stuff seems to work, fine. I needed to setup the new IPA servers by modifying UID/GID_MAX since in the early versions of the installation there wasn't a "check" for these attributes. I needed to do this since the existing IPA server uses UID/GIDs starting from 6000. Running: ipa migrate-ds --with-compat --user-container='cn=users,cn=accounts' --group-container='cn=groups,cn=accounts ipa.example.com However, I see that all the users that used to belong to "admins" have now dissapeard, is there a way to avoid this? Or is there any attribute I should think of while migrating? PS: I'm aware that the suggested method of migrating is Rhel7 > Rhel8 > Rhel9, however, it's seems to work fine without.

3 4

Migrating a Large OpenLDAP directory
by Chris Cowan 21 Jun '23

21 Jun '23

One other issue, I've encountered is in our existing OpenLDAP directory, with the private group for the user, the uid != gid. This would be easy to fix but we have our legacy gid space interspersed with the other supplemental groups we created. Presently, we're talking about 9K users and 130K groups. Both the uid and gid spaces were originally started at 100,000. I started noticing that NSS stuff wasn't working correctly for users where uid != gid. Even though the user object shows the correct uid and gid. Reading bugzilla, and other posts on this list. It appears that I am not alone. The workaround suggested, which I tried. - Detach the private group from the user - Delete the private group - Recreate with a group-add Just wondering if there's new advice on this particular scenario: Migration of an existing LDAP directory where the private gid is not in sync with the user's uid Going forward, it seems the best thing to do would be to pick distinct ranges for users and associated groups, vs the supplemental.

2 3

Valid characters in group names
by Chris Cowan 20 Jun '23

20 Jun '23

Would it be possible to loosen the restrictions on group names to allow a forward slash? We are migrating a large OpenLDAP directory, and they adopted a pseudo-hierarchical group naming standard using "/". Alphanumerics, and [-_.] were allowed between forward slashes. This was inherited from an older system based upon DCE (yeah, I know old stuff ;) For Plan B, I'm experimenting with different approaches like use '.' instead of slash. But, wondering if this would be a simple tweak.

2 2

Without GSSAPIStrictAcceptorCheck=no, sshd shows a "wrong hostname"?
by Alex Corcoles 18 Jun '23

18 Jun '23

Hi, I have a Debian (Proxmox) system joined to FreeIPA. I'm trying to log in via SSH using Kerberos, but it doesn't work. If I start a debug SSH server, I get the following output: No key table entry found matching host/h1.h1.int.example.net@ , but hostname -f on the same host reports h1.example.net. /etc/resolv.conf has h1.int.example.net as the domain/search parameter. I think sshd is getting the hostname messed up somehow. Things work if GSSAPIStrictAcceptorCheck=no, but is there something I can fix? Cheers, Álex

1 0

Without GSSAPIStrictAcceptorCheck=no, sshd shows a "wrong hostname"?
by Alex Corcoles 18 Jun '23

18 Jun '23

Hi, I have a Debian (Proxmox) system joined to FreeIPA. I'm trying to log in via SSH using Kerberos, but it doesn't work. If I start a debug SSH server, I get the following output: No key table entry found matching host/h1.h1.int.example.net@ , but hostname -f on the same host reports h1.example.net. /etc/resolv.conf has h1.int.pdp7.net as the domain/search parameter. I think sshd is getting the hostname messed up somehow. Things work if GSSAPIStrictAcceptorCheck=no, but is there something I can fix? Cheers, Álex

1 0

FreeIPA and AIX - sudoers_base
by Ronald Wimmer 16 Jun '23

16 Jun '23

We managed to integrate AIX IPA clients successfully some time ago. sudo was also working fine. A few weeks ago sudo stopped working. The /etc/ldap.conf on our AIX clients contains the following line: sudoers_base cn=users,cn=compat,ou=sudoers,dc=linux,dc=mydomain,dc=at If we try to look that up with an LDAP browser we do not even find a OU named "sudoers". Did the LDAP structure change in the recent past? What should the sudoers_base line contain? Cheers, Ronald

3 6

firewall - masters VS clients
by lejeczek 15 Jun '23

15 Jun '23

Hi guys. Are there any ports/services which clients do not need and which can be exclusively allowed only to/between masters/replicas access? many thanks, L.

3 4

Windows10 desktop login fails with the FreeIPA users
by Ray R 14 Jun '23

14 Jun '23

Hello, I encountered an issue with Windows10 integration with FreeIPA server where at desktop login it says, user name or password is incorrect. RDP session is successful but login to the desktop fails with user name or password is incorrect. The windows client has successfully joined the FreeIPA server. IPA server is also the DNS server. The same user can login linux IPA client successfully. krb5 log shows (the last line)- Jun 12 14:01:29 ipa-server.dc1.abc.com krb5kdc[11611](info): TGS_REQ (5 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23), DEPRECATED:arcfour-hmac-exp(24), UNSUPPORTED:(-135)}) 10.2.1.23: ISSUE: authtime 1686603689, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, test(a)DC1.ABC.COM for host/desktop-client.dc1.abc.com(a)DC1.ABC.COM I followed the steps from https://www.freeipa.org/page/Windows_authentication_against_FreeIPA and https://www.rootusers.com/how-to-login-to-windows-with-a-freeipa-account/#c… but desktop login failed. Any suggestion is appreciated.

2 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users June 2023