June 2023 - FreeIPA-users - Fedora mailing-lists

Re: Authentication failures on a RHEL 9.2 IPA server
by GoNiS 13 Jun '23

13 Jun '23

I tried the trick of running: ipa config-mod --add-sids --enable-sid on my 2 ipa servers (one in 8 and one in 9) and it did not cure the authentication problem for my clients hitting the newest sever. The disable_pac=true trick did the work, but it is unsafe. I wonder if I need to issue the ipa idrange... command as proposed by Charles some messages above. Cheers, Isidro

2 3

freeipa and disa stig
by risto hartikainen 13 Jun '23

13 Jun '23

Hello, I am interested to know if there is any documentation available (and kept up to date) about hardening operating system with disa stig and install freeipa server on it. Since I dont have deeper knowledge about freeipa components, I have managed to create pretty interesting effects after installing freeipa on hardened rhel 7 & 8. With scap-workbench its too easy to select aggressive security settings.. and debug is painful task and difficult to determine if possible problems are related to hardening or to ipa itself. Almost every time its from hardening but finding out exactly which one gives headache. I guess it might be easier to point out components that clearly are not compatible with freeipa server but I have not found such document. Any tips about this? Thank you in advance, risto

1 0

Search for user by krbPrincipalExpiration
by Sebastian Knust 13 Jun '23

13 Jun '23

Hi, Is there a way to search for users by krbPrincipalExpiration date without resorting to direct LDAP queries? We currently use this attribute to set the end date of employees with fixed-term contracts. We would like to fire off some offboarding procedures based on the attribute. The IPA API/CLI currently does not return any users for searches by that attribute: $> ipa --version VERSION: 4.9.11, API_VERSION: 2.251 $> ipa user-show xredactedx User login: xredactedx First name: REDACTED Last name: REDACTED Home directory: /home/REDACTED Login shell: /bin/bash Principal name: xredactedx(a)IPA.PHYSIK.UNI-BIELEFELD.DE Principal alias: xredactedx(a)IPA.PHYSIK.UNI-BIELEFELD.DE Kerberos principal expiration: 20250801000000Z [...] $> ipa user-find --pkey-only --principal-expiration=20250801000000Z --------------- 0 users matched --------------- ---------------------------- Number of entries returned 0 ---------------------------- ldapsearch with filter krbprincipalexpiration=20250801000000Z returns the user as expected. Cheers Sebastian

2 5

Modifying FreeIPA/IDM User Schema
by Philippe de Rochambeau 12 Jun '23

12 Jun '23

Hello, what is the easiest way to modify an existing FreeIPA/iDM User Schema? I tried the following, in a dev environment : ipa config-mod --addattr=ipaGroupObjectClasses=newClass ...as recommended here https://www.freeipa.org/images/5/5b/FreeIPA33-extending-freeipa.pdf …but got a privilege message. I probably don’t belong to the right group. But assuming I do, can you modify the User Schema, on the fly, as above? Many thanks. Phil

2 3

Problems adding replica:NTP configuration cannot be updated during promotion
by Mauricio Tavares 12 Jun '23

12 Jun '23

I have two hosts; I will call them master (master.example.com) and future replica (replica.example.com) Both master and future replica are setup to use the same NTP servers. replica is currently registered as a client to master; I am able to login as a realm user, see my ticket using klist, and see the freeipa admin user. Before starting the replica install, I run the ipa-replica-conncheck on both master and replica, setting the respective master and replica: [root@master ~]# /usr/sbin/ipa-replica-conncheck --replica replica.example.com Check connection from master to remote replica 'replica.example.com': Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos KDC: TCP (88): OK Kerberos KDC: UDP (88): OK Kerberos Kpasswd: TCP (464): OK Kerberos Kpasswd: UDP (464): OK HTTP Server: Unsecure port (80): OK HTTP Server: Secure port (443): OK Connection from master to replica is OK. [root@master ~]#` So far so good. Based on https://www.freeipa.org/page/V4/NTP_Servers_Configuration#CLI, I used the ipa-replica-install with the --no-ntp option because I did not want the script to change the ntp settings. Here is the output: [root@replica ~]# ipa-replica-install --mkhomedir --no-ntp Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. NTP configuration cannot be updated during promotion The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information [root@replica ~]# Why does it want to "update the ntp configuration" given the --no-ntp option?

2 2

IPA fails to find certain AD groups
by Ronald Wimmer 12 Jun '23

12 Jun '23

When trying to add an AD group in an external group IPA fails to add certain groups. Error: "trusted domain object not found" These groups do definitely exist in AD. I checked every domain controller just to rule out an AD LDAP replication issue. I tried to replace a domain local group with a global group in the exact same OU. (group name differs only in one single letter) Trying to add the new group in IPA fails. Trying to add the old one (that has previously worked in IPA) again does also fail. VERSION: 4.9.11, API_VERSION: 2.251 I did some OS Updates recently containing: 0:idm-pki-acme-10.14.3-1.0.1.module+el8.8.0+20999+6d4394a9.noarch 0:idm-pki-base-10.14.3-1.0.1.module+el8.8.0+20999+6d4394a9.noarch 0:idm-pki-base-java-10.14.3-1.0.1.module+el8.8.0+20999+6d4394a9.noarch 0:idm-pki-ca-10.14.3-1.0.1.module+el8.8.0+20999+6d4394a9.noarch 0:idm-pki-kra-10.14.3-1.0.1.module+el8.8.0+20999+6d4394a9.noarch 0:idm-pki-server-10.14.3-1.0.1.module+el8.8.0+20999+6d4394a9.noarch 0:idm-pki-symkey-10.14.3-1.0.1.module+el8.8.0+20999+6d4394a9.x86_64 0:idm-pki-tools-10.14.3-1.0.1.module+el8.8.0+20999+6d4394a9.x86_64 0:ipa-client-4.9.11-5.0.1.module+el8.8.0+21013+a1d8660b.x86_64 0:ipa-client-common-4.9.11-5.0.1.module+el8.8.0+21013+a1d8660b.noarch 0:ipa-common-4.9.11-5.0.1.module+el8.8.0+21013+a1d8660b.noarch 0:ipa-healthcheck-0.12-1.module+el8.8.0+21013+a1d8660b.noarch 0:ipa-healthcheck-core-0.12-1.module+el8.8.0+21013+a1d8660b.noarch 0:ipa-selinux-4.9.11-5.0.1.module+el8.8.0+21013+a1d8660b.noarch 0:ipa-server-4.9.11-5.0.1.module+el8.8.0+21013+a1d8660b.x86_64 0:ipa-server-common-4.9.11-5.0.1.module+el8.8.0+21013+a1d8660b.noarch 0:ipa-server-trust-ad-4.9.11-5.0.1.module+el8.8.0+21013+a1d8660b.x86_64 and 0:python3-idm-pki-10.14.3-1.0.1.module+el8.8.0+20999+6d4394a9.noarch 0:python3-ipaclient-4.9.11-5.0.1.module+el8.8.0+21013+a1d8660b.noarch 0:python3-ipalib-4.9.11-5.0.1.module+el8.8.0+21013+a1d8660b.noarch 0:python3-ipaserver-4.9.11-5.0.1.module+el8.8.0+21013+a1d8660b.noarch (can provide full list if necessary) Maybe I introduced some kind of bug when updating... Cheers, Ronald

2 4

Easiest way to modify User Schema
by Philippe Roch 11 Jun '23

11 Jun '23

Hello, what is the easiest way to modify an existing FreeIPA/iDM User Schema? I tried the following in a dev environment : ipa config-mod --addattr=ipaGroupObjectClasses=newClass as recommended here https://www.freeipa.org/images/5/5b/FreeIPA33-extending-freeipa.pdf but got a privilege message. I probably don't belong to the right group. But assuming I do, can you modify the User Schema, on the fly, as above? Many thanks.

1 0

AD Trust not authenticating users
by James Osbourn 08 Jun '23

08 Jun '23

I have an inherited IPA domain that is a subdomain of an active directory domain, e.g. ipa.ad1.com as a child of ad1.com. The IPA domain has AD Trust enabled and a one way domain trust to another AD sub domain, e.g. we want to use user logins from the AD domain users.ad2.com which is a child domain of ad2.com. We are also using AD security group from the user.ad2.com domain to apply group based access control. e.g. we are using simple authentication on SSSD to limit who can login and using AD groups to define sudo access. This users domain and AD servers is managed by another team. Everything was working for some time and then we started seeing intermittent problems with authentication, a quick restart of the IPA server would resolve the problem temporarily, but then it would stop again. Even if we could login using SSH keys the sudo access would not work, it would appear to lose group membership details. I have recently updated all of the IPA nodes to RHEL9 and made sure that DNS is updated correctly. The sssd.conf configuration on the IPA server looks as follows [domain/ipa.ad1.com] debug_level = 6 id_provider = ipa ipa_server = ipa-3.ipa.ad1.com ipa_domain = ipa.ad1.com ipa_hostname = ipa-3.ipa.ad1.com auth_provider = ipa chpass_provider = ipa access_provider = ipa cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True sudo_provider = ipa autofs_provider = ipa subdomains_provider = ipa session_provider = ipa hostid_provider = ipa ipa_server_mode = True subdomain_homedir = /home/%u default_shell = /bin/bash override_shell = /bin/bash [sssd] services = nss, pam, sudo, ifp domains = ipa.ad1.com domain_resolution_order = users.ad2.com [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp] allowed_uids = ipaapi, root [session_recording] I have debug level 6 enabled on SSSD and when I check the domain status I see the following more often than not. The ad2.com forest domains are offline. They go online and then as soon as someone tries to login again then either both or just the users.ad2.com domain go offline which causes the login to fail. ipa.ad1.com Online status: Online ad1.com Online status: Online ad2.com Online status: Offline users.ad2.com Online status: Offline When I look at the SSSD domain logs I see the following (I have replaced internal domain names or hostname) * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.ifp] * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sss_domain_get_state] (0x1000): Domain ipa.ad1.com is Active * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sss_domain_get_state] (0x1000): Domain ad1.com is Active * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sss_domain_get_state] (0x1000): Domain AD2.COM is Active * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sbus_issue_request_done] (0x0400): sssd.DataProvider.Backend.IsOnline: Success * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sbus_dispatch] (0x4000): Dispatching. * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [_read_pipe_handler] (0x0400): [RID#1162] EOF received, client finished * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_get_tgt_recv] (0x0400): [RID#1162] Child responded: 0 [FILE:/var/lib/sss/db/ccache_AD2.COM] expired on [1686187555] * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_cli_auth_step] (0x0100): [RID#1162] expire timeout is 900 * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_cli_auth_step] (0x1000): [RID#1162] the connection will expire at 1686152455 * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sasl_bind_send] (0x0100): [RID#1162] Executing sasl bind mech: GSSAPI, user: AUTH$ * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sasl_bind_send] (0x0020): [RID#1162] ldap_sasl_interactive_bind_s failed (-2)[Local error] ********************** BACKTRACE DUMP ENDS HERE ********************************* (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sasl_bind_send] (0x0080): [RID#1162] Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)] (2023-06-07 16:25:55): [be[ipa.ad1.com]] [child_sig_handler] (0x0100): [RID#1162] child [9519] finished successfully. (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_cli_connect_recv] (0x0040): [RID#1162] Unable to establish connection [1432158227]: Authentication Failed ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sasl_bind_send] (0x0080): [RID#1162] Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)] * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [child_sig_handler] (0x1000): [RID#1162] Waiting for child [9519]. * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [child_sig_handler] (0x0100): [RID#1162] child [9519] finished successfully. * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_cli_connect_recv] (0x0040): [RID#1162] Unable to establish connection [1432158227]: Authentication Failed ********************** BACKTRACE DUMP ENDS HERE ********************************* (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0100): [RID#1162] Marking port 3268 of server 'ad1-dc-1.ad1.com' as 'not working' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0400): [RID#1162] Marking port 3268 of duplicate server 'ad1-dc-1.ad1.com' as 'not working' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_resolve_service_send] (0x0100): [RID#1162] Trying to resolve service 'sd_gc_AD2.COM' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [resolve_srv_send] (0x0200): [RID#1162] The status of SRV lookup is resolved (2023-06-07 16:25:55): [be[ipa.ad1.com]] [resolv_gethostbyname_files_send] (0x0100): [RID#1162] Trying to resolve A record of 'ad1-dc-3.ad1.com' in files (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_server_common_status] (0x0100): [RID#1162] Marking server 'ad1-dc-3.ad1.com' as 'resolving name' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [resolv_gethostbyname_files_send] (0x0100): [RID#1162] Trying to resolve AAAA record of 'ad1-dc-3.ad1.com' in files (2023-06-07 16:25:55): [be[ipa.ad1.com]] [resolv_gethostbyname_next] (0x0200): [RID#1162] No more address families to retry (2023-06-07 16:25:55): [be[ipa.ad1.com]] [resolv_gethostbyname_dns_query] (0x0100): [RID#1162] Trying to resolve A record of 'ad1-dc-3.ad1.com' in DNS (2023-06-07 16:25:55): [be[ipa.ad1.com]] [request_watch_destructor] (0x0400): [RID#1162] Deleting request watch (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_server_common_status] (0x0100): [RID#1162] Marking server 'ad1-dc-3.ad1.com' as 'name resolved' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [be_resolve_server_process] (0x0200): [RID#1162] Found address for server ad1-dc-3.ad1.com: [172.28.8.7] TTL 3600 (2023-06-07 16:25:55): [be[ipa.ad1.com]] [ad_resolve_callback] (0x0100): [RID#1162] Constructed uri 'ldap://ad1-dc-3.ad1.com' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [ad_resolve_callback] (0x0100): [RID#1162] Constructed GC uri 'ldap://ad1-dc-3.ad1.com:3268' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sssd_async_socket_init_send] (0x0400): [RID#1162] Setting 6 seconds timeout [ldap_network_timeout] for connecting (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_get_generic_ext_step] (0x0400): [RID#1162] calling ldap_search_ext with [(objectclass=*)][]. (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_get_generic_op_finished] (0x0400): [RID#1162] Search result: Success(0), no errmsg set (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_get_server_opts_from_rootdse] (0x0100): [RID#1162] Setting AD compatibility level to [7] (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_get_server_opts_from_rootdse] (0x0100): [RID#1162] Will look for schema at [CN=Schema,CN=Configuration,DC=ad1,DC=com] (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_kinit_send] (0x0400): [RID#1162] Attempting kinit (/var/lib/sss/keytabs/AD2.COM.keytab, AUTH$, AD2.COM, 86400) (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_resolve_service_send] (0x0100): [RID#1162] Trying to resolve service 'sd_AD2.COM' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [resolve_srv_send] (0x0200): [RID#1162] The status of SRV lookup is resolved (2023-06-07 16:25:55): [be[ipa.ad1.com]] [be_resolve_server_process] (0x0200): [RID#1162] Found address for server dcc01.ad2.com: [10.194.34.10] TTL 2107 (2023-06-07 16:25:55): [be[ipa.ad1.com]] [create_tgt_req_send_buffer] (0x0400): [RID#1162] buffer size: 73 (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_tgt_child_timeout] (0x0400): [RID#1162] Setting 8 seconds timeout for TGT child (2023-06-07 16:25:55): [be[ipa.ad1.com]] [_write_pipe_handler] (0x0400): [RID#1162] All data has been sent! (2023-06-07 16:25:55): [be[ipa.ad1.com]] [_read_pipe_handler] (0x0400): [RID#1162] EOF received, client finished (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_get_tgt_recv] (0x0400): [RID#1162] Child responded: 0 [FILE:/var/lib/sss/db/ccache_AD2.COM] expired on [1686187555] (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_cli_auth_step] (0x0100): [RID#1162] expire timeout is 900 (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sasl_bind_send] (0x0100): [RID#1162] Executing sasl bind mech: GSSAPI, user: AUTH$ (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sasl_bind_send] (0x0020): [RID#1162] ldap_sasl_interactive_bind_s failed (-2)[Local error] * ... skipping repetitive backtrace ... (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sasl_bind_send] (0x0080): [RID#1162] Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)] (2023-06-07 16:25:55): [be[ipa.ad1.com]] [child_sig_handler] (0x0100): [RID#1162] child [9522] finished successfully. (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_cli_connect_recv] (0x0040): [RID#1162] Unable to establish connection [1432158227]: Authentication Failed * ... skipping repetitive backtrace ... (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0100): [RID#1162] Marking port 3268 of server 'ad1-dc-3.ad1.com' as 'not working' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0400): [RID#1162] Marking port 3268 of duplicate server 'ad1-dc-3.ad1.com' as 'not working' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_resolve_service_send] (0x0100): [RID#1162] Trying to resolve service 'sd_gc_AD2.COM' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [resolve_srv_send] (0x0200): [RID#1162] The status of SRV lookup is resolved (2023-06-07 16:25:55): [be[ipa.ad1.com]] [resolv_gethostbyname_files_send] (0x0100): [RID#1162] Trying to resolve A record of 'ad1-dc-2.ad1.com' in files (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_server_common_status] (0x0100): [RID#1162] Marking server 'ad1-dc-2.ad1.com' as 'resolving name' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [resolv_gethostbyname_files_send] (0x0100): [RID#1162] Trying to resolve AAAA record of 'ad1-dc-2.ad1.com' in files (2023-06-07 16:25:55): [be[ipa.ad1.com]] [resolv_gethostbyname_next] (0x0200): [RID#1162] No more address families to retry (2023-06-07 16:25:55): [be[ipa.ad1.com]] [resolv_gethostbyname_dns_query] (0x0100): [RID#1162] Trying to resolve A record of 'ad1-dc-2.ad1.com' in DNS (2023-06-07 16:25:55): [be[ipa.ad1.com]] [request_watch_destructor] (0x0400): [RID#1162] Deleting request watch (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_server_common_status] (0x0100): [RID#1162] Marking server 'ad1-dc-2.ad1.com' as 'name resolved' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [be_resolve_server_process] (0x0200): [RID#1162] Found address for server ad1-dc-2.ad1.com: [172.28.8.6] TTL 3600 (2023-06-07 16:25:55): [be[ipa.ad1.com]] [ad_resolve_callback] (0x0100): [RID#1162] Constructed uri 'ldap://ad1-dc-2.ad1.com' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [ad_resolve_callback] (0x0100): [RID#1162] Constructed GC uri 'ldap://ad1-dc-2.ad1.com:3268' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sssd_async_socket_init_send] (0x0400): [RID#1162] Setting 6 seconds timeout [ldap_network_timeout] for connecting (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_get_generic_ext_step] (0x0400): [RID#1162] calling ldap_search_ext with [(objectclass=*)][]. (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_get_generic_op_finished] (0x0400): [RID#1162] Search result: Success(0), no errmsg set (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_get_server_opts_from_rootdse] (0x0100): [RID#1162] Setting AD compatibility level to [7] (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_get_server_opts_from_rootdse] (0x0100): [RID#1162] Will look for schema at [CN=Schema,CN=Configuration,DC=ad1,DC=com] (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_kinit_send] (0x0400): [RID#1162] Attempting kinit (/var/lib/sss/keytabs/AD2.COM.keytab, AUTH$, AD2.COM, 86400) (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_resolve_service_send] (0x0100): [RID#1162] Trying to resolve service 'sd_AD2.COM' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [resolve_srv_send] (0x0200): [RID#1162] The status of SRV lookup is resolved (2023-06-07 16:25:55): [be[ipa.ad1.com]] [be_resolve_server_process] (0x0200): [RID#1162] Found address for server dcc01.ad2.com: [10.194.34.10] TTL 2107 (2023-06-07 16:25:55): [be[ipa.ad1.com]] [create_tgt_req_send_buffer] (0x0400): [RID#1162] buffer size: 73 (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_tgt_child_timeout] (0x0400): [RID#1162] Setting 8 seconds timeout for TGT child (2023-06-07 16:25:55): [be[ipa.ad1.com]] [_write_pipe_handler] (0x0400): [RID#1162] All data has been sent! (2023-06-07 16:25:55): [be[ipa.ad1.com]] [_read_pipe_handler] (0x0400): [RID#1162] EOF received, client finished (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_get_tgt_recv] (0x0400): [RID#1162] Child responded: 0 [FILE:/var/lib/sss/db/ccache_AD2.COM] expired on [1686187555] (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_cli_auth_step] (0x0100): [RID#1162] expire timeout is 900 (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sasl_bind_send] (0x0100): [RID#1162] Executing sasl bind mech: GSSAPI, user: AUTH$ (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sasl_bind_send] (0x0020): [RID#1162] ldap_sasl_interactive_bind_s failed (-2)[Local error] * ... skipping repetitive backtrace ... (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sasl_bind_send] (0x0080): [RID#1162] Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)] (2023-06-07 16:25:55): [be[ipa.ad1.com]] [child_sig_handler] (0x0100): [RID#1162] child [9523] finished successfully. (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_cli_connect_recv] (0x0040): [RID#1162] Unable to establish connection [1432158227]: Authentication Failed * ... skipping repetitive backtrace ... (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0100): [RID#1162] Marking port 3268 of server 'ad1-dc-2.ad1.com' as 'not working' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0400): [RID#1162] Marking port 3268 of duplicate server 'ad1-dc-2.ad1.com' as 'not working' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_resolve_service_send] (0x0100): [RID#1162] Trying to resolve service 'sd_gc_AD2.COM' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [get_port_status] (0x0080): [RID#1162] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2023-06-07 16:25:55): [be[ipa.ad1.com]] [get_port_status] (0x0080): [RID#1162] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2023-06-07 16:25:55): [be[ipa.ad1.com]] [get_port_status] (0x0080): [RID#1162] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_resolve_service_send] (0x0020): [RID#1162] No available servers for service 'sd_gc_AD2.COM' ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [_be_fo_set_port_status] (0x8000): [RID#1162] Setting status: PORT_NOT_WORKING. Called from: src/providers/ldap/sdap_async_connection.c: sdap_cli_connect_recv: 2136 * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0100): [RID#1162] Marking port 3268 of server 'ad1-dc-2.ad1.com' as 'not working' * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0400): [RID#1162] Marking port 3268 of duplicate server 'ad1-dc-2.ad1.com' as 'not working' * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_handle_release] (0x2000): [RID#1162] Trace: sh[0x556c865496d0], connected[1], ops[(nil)], ldap[0x556c865f89b0], destructor_lock[0], release_memory[0] * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [remove_connection_callback] (0x4000): [RID#1162] Successfully removed connection callback. * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_id_op_connect_done] (0x4000): [RID#1162] attempting failover retry on op #1 * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_id_op_connect_step] (0x4000): [RID#1162] beginning to connect * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_resolve_service_send] (0x0100): [RID#1162] Trying to resolve service 'sd_gc_AD2.COM' * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [get_server_status] (0x1000): [RID#1162] Status of server 'ad1-dc-1.ad1.com' is 'name resolved' * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [get_port_status] (0x1000): [RID#1162] Port status of port 3268 for server 'ad1-dc-1.ad1.com' is 'not working' * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [get_port_status] (0x0080): [RID#1162] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [get_server_status] (0x1000): [RID#1162] Status of server 'ad1-dc-3.ad1.com' is 'name resolved' * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [get_port_status] (0x1000): [RID#1162] Port status of port 3268 for server 'ad1-dc-3.ad1.com' is 'not working' * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [get_port_status] (0x0080): [RID#1162] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [get_server_status] (0x1000): [RID#1162] Status of server 'ad1-dc-2.ad1.com' is 'name resolved' * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [get_port_status] (0x1000): [RID#1162] Port status of port 3268 for server 'ad1-dc-2.ad1.com' is 'not working' * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [get_port_status] (0x0080): [RID#1162] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_resolve_service_send] (0x0020): [RID#1162] No available servers for service 'sd_gc_AD2.COM' ********************** BACKTRACE DUMP ENDS HERE ********************************* (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_id_op_connect_done] (0x0400): [RID#1162] Failed to connect to server, but ignore mark offline is enabled. (2023-06-07 16:25:55): [be[ipa.ad1.com]] [ipa_srv_ad_acct_lookup_done] (0x0080): [RID#1162] Subdomain lookup failed, will try to reset subdomain. (2023-06-07 16:25:55): [be[ipa.ad1.com]] [ipa_server_trusted_dom_setup_1way] (0x0400): [RID#1162] Will re-fetch keytab for USERS.AD2.COM (2023-06-07 16:25:55): [be[ipa.ad1.com]] [ipa_getkeytab_send] (0x0400): [RID#1162] Retrieving keytab for AUTH$(a)AD2.COM from ipa-3.ipa.ad1.com into /var/lib/sss/keytabs/AD2.COM.keytabIw4R58 using ccache /var/lib/sss/db/ccache_AUTH.SSDIS.LOC (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sbus_issue_request_done] (0x0400): sssd.DataProvider.Backend.IsOnline: Success (2023-06-07 16:25:55): [be[ipa.ad1.com]] [child_sig_handler] (0x0100): [RID#1162] child [9524] finished successfully. (2023-06-07 16:25:55): [be[ipa.ad1.com]] [ipa_server_trust_1way_kt_done] (0x0400): [RID#1162] Keytab successfully retrieved to /var/lib/sss/keytabs/AD2.COM.keytabIw4R58 (2023-06-07 16:25:55): [be[ipa.ad1.com]] [ipa_server_trust_1way_kt_done] (0x0400): [RID#1162] Keytab /var/lib/sss/keytabs/AD2.COM.keytabIw4R58 contains the expected principals (2023-06-07 16:25:55): [be[ipa.ad1.com]] [ipa_server_trust_1way_kt_done] (0x0400): [RID#1162] Established trust context for USERS.AD2.COM (2023-06-07 16:25:55): [be[ipa.ad1.com]] [ipa_srv_ad_acct_retried] (0x0400): [RID#1162] Subdomain re-set, will retry lookup (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_srv_data_status] (0x0100): [RID#1162] Marking SRV lookup of service 'sd_USERS.AD2.COM' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_server_common_status] (0x0100): [RID#1162] Marking server 'dcf01.users.ad2.com' as 'name not resolved' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0100): [RID#1162] Marking port 389 of server 'dcf01.users.ad2.com' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0400): [RID#1162] Marking port 389 of duplicate server 'dcf01.users.ad2.com' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_srv_data_status] (0x0100): [RID#1162] Marking SRV lookup of service 'sd_USERS.AD2.COM' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_server_common_status] (0x0100): [RID#1162] Marking server 'DCC02.USERS.AD2.COM' as 'name not resolved' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0100): [RID#1162] Marking port 389 of server 'DCC02.USERS.AD2.COM' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0400): [RID#1162] Marking port 389 of duplicate server 'DCC02.USERS.AD2.COM' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0400): [RID#1162] Marking port 389 of duplicate server 'DCC02.USERS.AD2.COM' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_srv_data_status] (0x0100): [RID#1162] Marking SRV lookup of service 'sd_USERS.AD2.COM' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_server_common_status] (0x0100): [RID#1162] Marking server 'dcs02.users.ad2.com' as 'name not resolved' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0100): [RID#1162] Marking port 389 of server 'dcs02.users.ad2.com' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0400): [RID#1162] Marking port 389 of duplicate server 'dcs02.users.ad2.com' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_srv_data_status] (0x0100): [RID#1162] Marking SRV lookup of service 'sd_USERS.AD2.COM' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_server_common_status] (0x0100): [RID#1162] Marking server 'dcf02.users.ad2.com' as 'name not resolved' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0100): [RID#1162] Marking port 389 of server 'dcf02.users.ad2.com' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0400): [RID#1162] Marking port 389 of duplicate server 'dcf02.users.ad2.com' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_srv_data_status] (0x0100): [RID#1162] Marking SRV lookup of service 'sd_USERS.AD2.COM' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_server_common_status] (0x0100): [RID#1162] Marking server 'dcc01.users.ad2.com' as 'name not resolved' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0100): [RID#1162] Marking port 389 of server 'dcc01.users.ad2.com' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0400): [RID#1162] Marking port 389 of duplicate server 'dcc01.users.ad2.com' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_srv_data_status] (0x0100): [RID#1162] Marking SRV lookup of service 'sd_USERS.AD2.COM' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_server_common_status] (0x0100): [RID#1162] Marking server 'DCC02.USERS.AD2.COM' as 'name not resolved' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0100): [RID#1162] Marking port 389 of server 'DCC02.USERS.AD2.COM' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0400): [RID#1162] Marking port 389 of duplicate server 'DCC02.USERS.AD2.COM' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0400): [RID#1162] Marking port 389 of duplicate server 'DCC02.USERS.AD2.COM' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_srv_data_status] (0x0100): [RID#1162] Marking SRV lookup of service 'sd_USERS.AD2.COM' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_server_common_status] (0x0100): [RID#1162] Marking server 'dcs03.users.ad2.com' as 'name not resolved' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0100): [RID#1162] Marking port 389 of server 'dcs03.users.ad2.com' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0400): [RID#1162] Marking port 389 of duplicate server 'dcs03.users.ad2.com' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [set_srv_data_status] (0x0100): [RID#1162] Marking SRV lookup of service 'sd_gc_USERS.AD2.COM' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_set_port_status] (0x0100): [RID#1162] Marking port 0 of server '(no name)' as 'neutral' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [ipa_srv_ad_acct_lookup_step] (0x0400): [RID#1162] Looking up AD account (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_resolve_service_send] (0x0100): [RID#1162] Trying to resolve service 'sd_gc_AD2.COM' (2023-06-07 16:25:55): [be[ipa.ad1.com]] [get_port_status] (0x0080): [RID#1162] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2023-06-07 16:25:55): [be[ipa.ad1.com]] [get_port_status] (0x0080): [RID#1162] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2023-06-07 16:25:55): [be[ipa.ad1.com]] [get_port_status] (0x0080): [RID#1162] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2023-06-07 16:25:55): [be[ipa.ad1.com]] [fo_resolve_service_send] (0x0020): [RID#1162] No available servers for service 'sd_gc_AD2.COM' * ... skipping repetitive backtrace ... (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_id_op_connect_done] (0x0400): [RID#1162] Failed to connect to server, but ignore mark offline is enabled. (2023-06-07 16:25:55): [be[ipa.ad1.com]] [ipa_srv_ad_acct_lookup_done] (0x0040): [RID#1162] ipa_get_*_acct request failed: [1432158276]: Subdomain is inactive. ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [be_resolve_server_done] (0x1000): [RID#1162] Server [NULL] resolution failed: [5]: Input/output error * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_id_op_connect_done] (0x0400): [RID#1162] Failed to connect to server, but ignore mark offline is enabled. * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [sdap_id_op_connect_done] (0x4000): [RID#1162] notify error to op #1: 5 [Input/output error] * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [be_mark_dom_offline] (0x1000): [RID#1162] Marking subdomain USERS.AD2.COM offline * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [be_mark_subdom_offline] (0x1000): [RID#1162] Marking subdomain USERS.AD2.COM as inactive * (2023-06-07 16:25:55): [be[ipa.ad1.com]] [ipa_srv_ad_acct_lookup_done] (0x0040): [RID#1162] ipa_get_*_acct request failed: [1432158276]: Subdomain is inactive. ********************** BACKTRACE DUMP ENDS HERE ********************************* As far as I can tell the users.ad2.com domain is "Active", but the bind fails to the domain which forces a domain check to take place. Ultimately, this fails and the domain is flagged offline so the authentication fails. There seems to be some odd lines where the users.ad2.com validation is trying to connect to servers from the ad1.com domain and global catalog validation which is failing. Not sure why this would be taking place. This seems to culminate in the line (2023-06-07 16:25:55): [be[auth.ssdis.loc]] [fo_resolve_service_send] (0x0020): [RID#1162] No available servers for service 'sd_gc_AD2.COM' I can see actions taking place but cannot determine why they are taking place. I can kinit as a users.ad2.com user successfully. Likewise I can getent users and groups successfully and see the details correctly. Yet authentication and authorisation is failing for SSH logins Any help or guidance on resolving this problem would be appreciated.

2 3

Do keytabs expire?
by Ronald Wimmer 07 Jun '23

07 Jun '23

Hi, today I found out that some entries in a keytab file seemed to have expired: Request ticket server HTTP/mwc.linux.mydomain.at(a)LINUX.MYDOMAIN.AT kvno 4 not found in keytab; keytab is likely out of date Fetching the keytab again with ipa-getkeytab fixed the problem. But why is this happening? Do keytab entries expire? I have not set any custom password or ticket policies. Regards, Ronald

4 13

FreeIPA 4.10.2
by Antonio Torres 06 Jun '23

06 Jun '23

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users June 2023