10:29 a.m.
We have smartcards (PIV) working just fine on Fedora 25 with FreeIPA client
version 4.4.4 (SSSD 1.14.2). However on Ubuntu 16.04, FreeIPA client
4.3.1, SSSD 1.13.4 the smartcard seems to be ignored.
The smartcard is readable using pkcs11-tools and pkcs15-tools on both
systems.
On both systems sssd.conf contains:
[pam]
pam_cert_auth = True
I've turned the sssd logging up to 9 on both systems and it looks like
p11_child is never called on the Ubuntu system. On the Ubuntu system
p11_child.log is empty and there is no sign of it being started in the
sssd_pam.log.
Any suggestions on what I should look at next?
Thanks,
Steve
10:40 a.m.
On Thu, Sep 28, 2017 at 11:29:27AM -0400, Steve Weeks via FreeIPA-users wrote:
We have smartcards (PIV) working just fine on Fedora 25 with FreeIPA
client
version 4.4.4 (SSSD 1.14.2). However on Ubuntu 16.04, FreeIPA client
4.3.1, SSSD 1.13.4 the smartcard seems to be ignored.
The smartcard is readable using pkcs11-tools and pkcs15-tools on both
systems.
On both systems sssd.conf contains:
[pam]
pam_cert_auth = True
I've turned the sssd logging up to 9 on both systems and it looks like
p11_child is never called on the Ubuntu system. On the Ubuntu system
p11_child.log is empty and there is no sign of it being started in the
sssd_pam.log.
Any suggestions on what I should look at next?
How does your PAM configuration looks like? You have to make sure that
pam_sss.so is the first module called for SSSD users. If pam_unix comes
first it will ask for a Password and pass it on to pam_sss.so which will
try password authentication in this case.
HTH
bye,
Sumit
Thanks,
Steve
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
11:13 a.m.
In all cases on both system pam_unix comes before pam_sss. For example in
Fedora system-auth it is:
auth [success=done ignore=ignore default=die] pam_unix.so nullok
try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
and in Ubuntu common-auth it is:
auth [success=2 default=ignore] pam_unix.so nullok_secure
auth [success=1 default=ignore] pam_sss.so use_first_pass
I tried reversing the lines and get a pam error about user not know (it is
an AD user which works fine on fedora).
Also, it looks like pam_pkcs11.so is used in smartcard-auth on Fedora.
Don't know if this is relevant or not.
Steve
On Thu, Sep 28, 2017 at 11:40 AM, Sumit Bose via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
On Thu, Sep 28, 2017 at 11:29:27AM -0400, Steve Weeks via
FreeIPA-users
wrote:
> We have smartcards (PIV) working just fine on Fedora 25 with FreeIPA
client
> version 4.4.4 (SSSD 1.14.2). However on Ubuntu 16.04, FreeIPA client
> 4.3.1, SSSD 1.13.4 the smartcard seems to be ignored.
>
> The smartcard is readable using pkcs11-tools and pkcs15-tools on both
> systems.
>
> On both systems sssd.conf contains:
> [pam]
> pam_cert_auth = True
>
> I've turned the sssd logging up to 9 on both systems and it looks like
> p11_child is never called on the Ubuntu system. On the Ubuntu system
> p11_child.log is empty and there is no sign of it being started in the
> sssd_pam.log.
>
> Any suggestions on what I should look at next?
How does your PAM configuration looks like? You have to make sure that
pam_sss.so is the first module called for SSSD users. If pam_unix comes
first it will ask for a Password and pass it on to pam_sss.so which will
try password authentication in this case.
HTH
bye,
Sumit
>
> Thanks,
> Steve
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave@lists.
fedorahosted.org
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
11:43 a.m.
On Thu, Sep 28, 2017 at 12:13:38PM -0400, Steve Weeks wrote:
In all cases on both system pam_unix comes before pam_sss. For
example in
Fedora system-auth it is:
On recent Fedora systems you should have
auth [default=1 success=ok] pam_localuser.so
before the lines below. This will call pam_unix only for users from
/etc/passwd and skip the line it otherwise (default=1). Maybe something
like this would help on Ubuntu as well?
bye,
Sumit
>
> auth [success=done ignore=ignore default=die] pam_unix.so nullok
> try_first_pass
> auth requisite pam_succeed_if.so uid >= 1000 quiet_success
> auth sufficient pam_sss.so forward_pass
>
> and in Ubuntu common-auth it is:
>
> auth [success=2 default=ignore] pam_unix.so nullok_secure
> auth [success=1 default=ignore] pam_sss.so use_first_pass
>
> I tried reversing the lines and get a pam error about user not know (it is
> an AD user which works fine on fedora).
>
> Also, it looks like pam_pkcs11.so is used in smartcard-auth on Fedora.
> Don't know if this is relevant or not.
>
> Steve
>
>
> On Thu, Sep 28, 2017 at 11:40 AM, Sumit Bose via FreeIPA-users <
> freeipa-users(a)lists.fedorahosted.org> wrote:
>
> > On Thu, Sep 28, 2017 at 11:29:27AM -0400, Steve Weeks via FreeIPA-users
> > wrote:
> > > We have smartcards (PIV) working just fine on Fedora 25 with FreeIPA
> > client
> > > version 4.4.4 (SSSD 1.14.2). However on Ubuntu 16.04, FreeIPA client
> > > 4.3.1, SSSD 1.13.4 the smartcard seems to be ignored.
> > >
> > > The smartcard is readable using pkcs11-tools and pkcs15-tools on both
> > > systems.
> > >
> > > On both systems sssd.conf contains:
> > > [pam]
> > > pam_cert_auth = True
> > >
> > > I've turned the sssd logging up to 9 on both systems and it looks like
> > > p11_child is never called on the Ubuntu system. On the Ubuntu system
> > > p11_child.log is empty and there is no sign of it being started in the
> > > sssd_pam.log.
> > >
> > > Any suggestions on what I should look at next?
> >
> > How does your PAM configuration looks like? You have to make sure that
> > pam_sss.so is the first module called for SSSD users. If pam_unix comes
> > first it will ask for a Password and pass it on to pam_sss.so which will
> > try password authentication in this case.
> >
> > HTH
> >
> > bye,
> > Sumit
> >
> > >
> > > Thanks,
> > > Steve
> >
> > > _______________________________________________
> > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to freeipa-users-leave@lists.
> > fedorahosted.org
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> >
1:35 p.m.
Progress, but still not using the smartcard and falling back to the
password.
I changed to change the pam_sss line in common-auth too:
auth [default=1 success=ok] pam_localuser.so
auth [success=2 default=ignore] pam_unix.so nullok_secure
#auth [success=1 default=ignore] pam_sss.so use_first_pass
auth sufficient pam_sss.so forward_pass
Now p11_child is called, but doesn't validate the certificate. On Fedora
the final line in p11_child.log is "Ceritificate verified and validated".
On Ubuntu that line is missing.
The root certificate is in the certdb. (certutil -d /etc/pki/nssdb -L).
Is there a way to do what p11_child does from the command line or with
better logging so I can what it doesn't like? I have debug_level = 9 on
everything at the moment.
Thanks,
Steve
On Thu, Sep 28, 2017 at 12:43 PM, Sumit Bose <sbose(a)redhat.com> wrote:
On Thu, Sep 28, 2017 at 12:13:38PM -0400, Steve Weeks wrote:
> In all cases on both system pam_unix comes before pam_sss. For example
in
> Fedora system-auth it is:
On recent Fedora systems you should have
auth [default=1 success=ok] pam_localuser.so
before the lines below. This will call pam_unix only for users from
/etc/passwd and skip the line it otherwise (default=1). Maybe something
like this would help on Ubuntu as well?
bye,
Sumit
>
> auth [success=done ignore=ignore default=die] pam_unix.so nullok
> try_first_pass
> auth requisite pam_succeed_if.so uid >= 1000 quiet_success
> auth sufficient pam_sss.so forward_pass
>
> and in Ubuntu common-auth it is:
>
> auth [success=2 default=ignore] pam_unix.so nullok_secure
> auth [success=1 default=ignore] pam_sss.so use_first_pass
>
> I tried reversing the lines and get a pam error about user not know (it
is
> an AD user which works fine on fedora).
>
> Also, it looks like pam_pkcs11.so is used in smartcard-auth on Fedora.
> Don't know if this is relevant or not.
>
> Steve
>
>
> On Thu, Sep 28, 2017 at 11:40 AM, Sumit Bose via FreeIPA-users <
> freeipa-users(a)lists.fedorahosted.org> wrote:
>
> > On Thu, Sep 28, 2017 at 11:29:27AM -0400, Steve Weeks via FreeIPA-users
> > wrote:
> > > We have smartcards (PIV) working just fine on Fedora 25 with FreeIPA
> > client
> > > version 4.4.4 (SSSD 1.14.2). However on Ubuntu 16.04, FreeIPA client
> > > 4.3.1, SSSD 1.13.4 the smartcard seems to be ignored.
> > >
> > > The smartcard is readable using pkcs11-tools and pkcs15-tools on both
> > > systems.
> > >
> > > On both systems sssd.conf contains:
> > > [pam]
> > > pam_cert_auth = True
> > >
> > > I've turned the sssd logging up to 9 on both systems and it looks
like
> > > p11_child is never called on the Ubuntu system. On the Ubuntu system
> > > p11_child.log is empty and there is no sign of it being started in
the
> > > sssd_pam.log.
> > >
> > > Any suggestions on what I should look at next?
> >
> > How does your PAM configuration looks like? You have to make sure that
> > pam_sss.so is the first module called for SSSD users. If pam_unix comes
> > first it will ask for a Password and pass it on to pam_sss.so which
will
> > try password authentication in this case.
> >
> > HTH
> >
> > bye,
> > Sumit
> >
> > >
> > > Thanks,
> > > Steve
> >
> > > _______________________________________________
> > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to freeipa-users-leave@lists.
> > fedorahosted.org
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to freeipa-users-leave@lists.
fedorahosted.org
> >
2:17 a.m.
On Thu, Sep 28, 2017 at 02:35:55PM -0400, Steve Weeks wrote:
Progress, but still not using the smartcard and falling back to the
password.
I changed to change the pam_sss line in common-auth too:
auth [default=1 success=ok] pam_localuser.so
auth [success=2 default=ignore] pam_unix.so nullok_secure
#auth [success=1 default=ignore] pam_sss.so use_first_pass
auth sufficient pam_sss.so forward_pass
Now p11_child is called, but doesn't validate the certificate. On Fedora
the final line in p11_child.log is "Ceritificate verified and validated".
On Ubuntu that line is missing.
The root certificate is in the certdb. (certutil -d /etc/pki/nssdb -L).
Is there a way to do what p11_child does from the command line or with
better logging so I can what it doesn't like? I have debug_level = 9 on
everything at the moment.
/usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --pre --nssdb=/etc/pki/nssdb
should do the trick.
HTH
bye,
Sumit
>
> Thanks,
> Steve
>
>
> On Thu, Sep 28, 2017 at 12:43 PM, Sumit Bose <sbose(a)redhat.com> wrote:
>
> > On Thu, Sep 28, 2017 at 12:13:38PM -0400, Steve Weeks wrote:
> > > In all cases on both system pam_unix comes before pam_sss. For example
> > in
> > > Fedora system-auth it is:
> >
> > On recent Fedora systems you should have
> >
> > auth [default=1 success=ok] pam_localuser.so
> >
> > before the lines below. This will call pam_unix only for users from
> > /etc/passwd and skip the line it otherwise (default=1). Maybe something
> > like this would help on Ubuntu as well?
> >
> > bye,
> > Sumit
> >
> > >
> > > auth [success=done ignore=ignore default=die] pam_unix.so nullok
> > > try_first_pass
> > > auth requisite pam_succeed_if.so uid >= 1000 quiet_success
> > > auth sufficient pam_sss.so forward_pass
> > >
> > > and in Ubuntu common-auth it is:
> > >
> > > auth [success=2 default=ignore] pam_unix.so nullok_secure
> > > auth [success=1 default=ignore] pam_sss.so use_first_pass
> > >
> > > I tried reversing the lines and get a pam error about user not know (it
> > is
> > > an AD user which works fine on fedora).
> > >
> > > Also, it looks like pam_pkcs11.so is used in smartcard-auth on Fedora.
> > > Don't know if this is relevant or not.
> > >
> > > Steve
> > >
> > >
> > > On Thu, Sep 28, 2017 at 11:40 AM, Sumit Bose via FreeIPA-users <
> > > freeipa-users(a)lists.fedorahosted.org> wrote:
> > >
> > > > On Thu, Sep 28, 2017 at 11:29:27AM -0400, Steve Weeks via
FreeIPA-users
> > > > wrote:
> > > > > We have smartcards (PIV) working just fine on Fedora 25 with
FreeIPA
> > > > client
> > > > > version 4.4.4 (SSSD 1.14.2). However on Ubuntu 16.04, FreeIPA
client
> > > > > 4.3.1, SSSD 1.13.4 the smartcard seems to be ignored.
> > > > >
> > > > > The smartcard is readable using pkcs11-tools and pkcs15-tools on
both
> > > > > systems.
> > > > >
> > > > > On both systems sssd.conf contains:
> > > > > [pam]
> > > > > pam_cert_auth = True
> > > > >
> > > > > I've turned the sssd logging up to 9 on both systems and it
looks
> > like
> > > > > p11_child is never called on the Ubuntu system. On the Ubuntu
system
> > > > > p11_child.log is empty and there is no sign of it being started
in
> > the
> > > > > sssd_pam.log.
> > > > >
> > > > > Any suggestions on what I should look at next?
> > > >
> > > > How does your PAM configuration looks like? You have to make sure
that
> > > > pam_sss.so is the first module called for SSSD users. If pam_unix
comes
> > > > first it will ask for a Password and pass it on to pam_sss.so which
> > will
> > > > try password authentication in this case.
> > > >
> > > > HTH
> > > >
> > > > bye,
> > > > Sumit
> > > >
> > > > >
> > > > > Thanks,
> > > > > Steve
> > > >
> > > > > _______________________________________________
> > > > > FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org
> > > > > To unsubscribe send an email to freeipa-users-leave@lists.
> > > > fedorahosted.org
> > > > _______________________________________________
> > > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > > To unsubscribe send an email to freeipa-users-leave@lists.
> > fedorahosted.org
> > > >
> >
10:17 a.m.
That works, but it is only pre-auth mode. In --auth mode it fails, but I
don't think that relevant since fails the same way on Fedora too.
The problems seems to be that on Ubuntu, --auth mode is never called. On
Fedora p11_child is called twice. Once with --pre and then a second time
with --auth. In the log you see:
$ egrep 'main|verified' p11_child.log
(Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main] (0x0400):
p11_child started.
(Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main] (0x2000):
Running in [pre-auth] mode.
(Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main] (0x2000):
Running with effective IDs: [0][0].
(Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main] (0x2000):
Running with real IDs [0][0].
(Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main] (0x0400):
p11_child started.
(Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main] (0x2000):
Running in [auth] mode.
(Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main] (0x2000):
Running with effective IDs: [0][0].
(Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main] (0x2000):
Running with real IDs [0][0].
(Thu Sep 28 14:23:23 2017) [[sssd[p11_child[15378]]]] [do_work] (0x4000):
Certificate verified and validated.
I've trimmed the log to what (I think) was interesting. I can send
everything if you need it.
For Ubuntu, the log stops after the first invocation of p11_child and you
never see the [auth] mode call. Otherwise the logs are the same.
Steve
On Fri, Sep 29, 2017 at 3:17 AM, Sumit Bose <sbose(a)redhat.com> wrote:
On Thu, Sep 28, 2017 at 02:35:55PM -0400, Steve Weeks wrote:
> Progress, but still not using the smartcard and falling back to the
> password.
>
> I changed to change the pam_sss line in common-auth too:
>
> auth [default=1 success=ok] pam_localuser.so
> auth [success=2 default=ignore] pam_unix.so nullok_secure
> #auth [success=1 default=ignore] pam_sss.so use_first_pass
> auth sufficient pam_sss.so forward_pass
>
> Now p11_child is called, but doesn't validate the certificate. On Fedora
> the final line in p11_child.log is "Ceritificate verified and validated".
> On Ubuntu that line is missing.
>
> The root certificate is in the certdb. (certutil -d /etc/pki/nssdb -L).
>
> Is there a way to do what p11_child does from the command line or with
> better logging so I can what it doesn't like? I have debug_level = 9 on
> everything at the moment.
/usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --pre
--nssdb=/etc/pki/nssdb
should do the trick.
HTH
bye,
Sumit
>
> Thanks,
> Steve
>
>
> On Thu, Sep 28, 2017 at 12:43 PM, Sumit Bose <sbose(a)redhat.com> wrote:
>
> > On Thu, Sep 28, 2017 at 12:13:38PM -0400, Steve Weeks wrote:
> > > In all cases on both system pam_unix comes before pam_sss. For
example
> > in
> > > Fedora system-auth it is:
> >
> > On recent Fedora systems you should have
> >
> > auth [default=1 success=ok] pam_localuser.so
> >
> > before the lines below. This will call pam_unix only for users from
> > /etc/passwd and skip the line it otherwise (default=1). Maybe something
> > like this would help on Ubuntu as well?
> >
> > bye,
> > Sumit
> >
> > >
> > > auth [success=done ignore=ignore default=die] pam_unix.so
nullok
> > > try_first_pass
> > > auth requisite pam_succeed_if.so uid >= 1000 quiet_success
> > > auth sufficient pam_sss.so forward_pass
> > >
> > > and in Ubuntu common-auth it is:
> > >
> > > auth [success=2 default=ignore] pam_unix.so nullok_secure
> > > auth [success=1 default=ignore] pam_sss.so use_first_pass
> > >
> > > I tried reversing the lines and get a pam error about user not know
(it
> > is
> > > an AD user which works fine on fedora).
> > >
> > > Also, it looks like pam_pkcs11.so is used in smartcard-auth on
Fedora.
> > > Don't know if this is relevant or not.
> > >
> > > Steve
> > >
> > >
> > > On Thu, Sep 28, 2017 at 11:40 AM, Sumit Bose via FreeIPA-users <
> > > freeipa-users(a)lists.fedorahosted.org> wrote:
> > >
> > > > On Thu, Sep 28, 2017 at 11:29:27AM -0400, Steve Weeks via
FreeIPA-users
> > > > wrote:
> > > > > We have smartcards (PIV) working just fine on Fedora 25 with
FreeIPA
> > > > client
> > > > > version 4.4.4 (SSSD 1.14.2). However on Ubuntu 16.04, FreeIPA
client
> > > > > 4.3.1, SSSD 1.13.4 the smartcard seems to be ignored.
> > > > >
> > > > > The smartcard is readable using pkcs11-tools and pkcs15-tools
on
both
> > > > > systems.
> > > > >
> > > > > On both systems sssd.conf contains:
> > > > > [pam]
> > > > > pam_cert_auth = True
> > > > >
> > > > > I've turned the sssd logging up to 9 on both systems and it
looks
> > like
> > > > > p11_child is never called on the Ubuntu system. On the Ubuntu
system
> > > > > p11_child.log is empty and there is no sign of it being started
in
> > the
> > > > > sssd_pam.log.
> > > > >
> > > > > Any suggestions on what I should look at next?
> > > >
> > > > How does your PAM configuration looks like? You have to make sure
that
> > > > pam_sss.so is the first module called for SSSD users. If pam_unix
comes
> > > > first it will ask for a Password and pass it on to pam_sss.so which
> > will
> > > > try password authentication in this case.
> > > >
> > > > HTH
> > > >
> > > > bye,
> > > > Sumit
> > > >
> > > > >
> > > > > Thanks,
> > > > > Steve
> > > >
> > > > > _______________________________________________
> > > > > FreeIPA-users mailing list -- freeipa-users@lists.
fedorahosted.org
> > > > > To unsubscribe send an email to freeipa-users-leave@lists.
> > > > fedorahosted.org
> > > > _______________________________________________
> > > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > > To unsubscribe send an email to freeipa-users-leave@lists.
> > fedorahosted.org
> > > >
> >
1:14 p.m.
The problem is definitely in sss_pam. From the logs, it sounds like it
can't get the certificate from the server.
p11_child works the same on both Fedora 25 and Ubuntu 16.04 in both
pre-auth and auth mode. To run in auth mode, change the command line to:
echo PIN | /usr/libexec/sssd/p11_child -d 10 --debug-fd=1
--nssdb=/etc/pki/nssdb --auth --pin
Running from the command line, both Fedora and Ubuntu return the same
results in either mode.
On Ubuntu running a real login, auth mode is never called. The
sssd_pam.log files are different. I've attached the full logs, but this is
what seems to be the problem.
Fedora, which works fine:
[sss_dp_issue_request] (0x0400): Issuing request for
[0x55e4aeaaa710:8:MIIHdjCCBV6gAwIBAgIT..
[sss_dp_get_account_msg] (0x0400): Creating request for [ipa.example.com][
*0x14][BE_REQ_BY_CERT*][1][cert=MIIHdjCCBV...
[sss_dp_internal_get_send] (0x0400): Entering request
[0x55e4aeaaa710:8:MIIHdjCCBV6gA.......
[cache_req_cache_search] (0x0040): Cache Request [User by certificate #0]:
Cannot find info for [CERT:S/kgorJq32@ipa.example.com]
[child_sig_handler] (0x1000): Waiting for child [5701].
[child_sig_handler] (0x0100): child [5701] finished successfully.
[sbus_remove_timeout] (0x2000): 0x55e4afa97210
[sbus_dispatch] (0x4000): dbus conn: 0x55e4afa9e7d0
[sbus_dispatch] (0x4000): Dispatching.
[sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code:
0 errno: 0 error message: Success
The same sequence in Ubuntu has a different call parameter and seems to
fail:
[sss_dp_issue_request] (0x0400): Issuing request for
[0x410090:8:MIIHdjCCBV6...
[sss_dp_get_account_msg] (0x0400): Creating request for
[ipa.example.com][*0x1014][FAST
BE_REQ_BY_CERT*][1][cert=MIIHdjCCBV6gAw...
[sbus_add_timeout] (0x2000): 0xc46200
[sss_dp_internal_get_send] (0x0400): Entering request
[0x410090:8:MIIHdjCCBV6g.....
[child_sig_handler] (0x1000): Waiting for child [9758].
[child_sig_handler] (0x0100): child [9758] finished successfully.
[sbus_remove_timeout] (0x2000): 0xc46200
[sssd[pam]] [sbus_dispatch] (0x4000): dbus conn: 0xc1a220
[sbus_dispatch] (0x4000): Dispatching.
[sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code:
3 errno: 0 error message: Account info lookup failed
Fedora is running sssd 1.14.2 and Ubuntu is running 1.13.4. The user is
from an AD trust. Both systems are attached to the same IPA server.
Is there some configuration change that will make the Ubuntu system behave
like the Fedora system? I'd really like to use the standard Ubuntu
distribution.
Thanks,
Steve
On Fri, Sep 29, 2017 at 11:17 AM, Steve Weeks <nbxsteve(a)gmail.com> wrote:
That works, but it is only pre-auth mode. In --auth mode it fails,
but I
don't think that relevant since fails the same way on Fedora too.
The problems seems to be that on Ubuntu, --auth mode is never called. On
Fedora p11_child is called twice. Once with --pre and then a second time
with --auth. In the log you see:
$ egrep 'main|verified' p11_child.log
(Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main] (0x0400):
p11_child started.
(Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main] (0x2000):
Running in [pre-auth] mode.
(Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main] (0x2000):
Running with effective IDs: [0][0].
(Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main] (0x2000):
Running with real IDs [0][0].
(Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main] (0x0400):
p11_child started.
(Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main] (0x2000):
Running in [auth] mode.
(Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main] (0x2000):
Running with effective IDs: [0][0].
(Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main] (0x2000):
Running with real IDs [0][0].
(Thu Sep 28 14:23:23 2017) [[sssd[p11_child[15378]]]] [do_work] (0x4000):
Certificate verified and validated.
I've trimmed the log to what (I think) was interesting. I can send
everything if you need it.
For Ubuntu, the log stops after the first invocation of p11_child and you
never see the [auth] mode call. Otherwise the logs are the same.
Steve
On Fri, Sep 29, 2017 at 3:17 AM, Sumit Bose <sbose(a)redhat.com> wrote:
> On Thu, Sep 28, 2017 at 02:35:55PM -0400, Steve Weeks wrote:
> > Progress, but still not using the smartcard and falling back to the
> > password.
> >
> > I changed to change the pam_sss line in common-auth too:
> >
> > auth [default=1 success=ok] pam_localuser.so
> > auth [success=2 default=ignore] pam_unix.so nullok_secure
> > #auth [success=1 default=ignore] pam_sss.so use_first_pass
> > auth sufficient pam_sss.so forward_pass
> >
> > Now p11_child is called, but doesn't validate the certificate. On
> Fedora
> > the final line in p11_child.log is "Ceritificate verified and
> validated".
> > On Ubuntu that line is missing.
> >
> > The root certificate is in the certdb. (certutil -d /etc/pki/nssdb -L).
> >
> > Is there a way to do what p11_child does from the command line or with
> > better logging so I can what it doesn't like? I have debug_level = 9 on
> > everything at the moment.
>
> /usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --pre
> --nssdb=/etc/pki/nssdb
>
> should do the trick.
>
> HTH
>
> bye,
> Sumit
>
> >
> > Thanks,
> > Steve
> >
> >
> > On Thu, Sep 28, 2017 at 12:43 PM, Sumit Bose <sbose(a)redhat.com> wrote:
> >
> > > On Thu, Sep 28, 2017 at 12:13:38PM -0400, Steve Weeks wrote:
> > > > In all cases on both system pam_unix comes before pam_sss. For
> example
> > > in
> > > > Fedora system-auth it is:
> > >
> > > On recent Fedora systems you should have
> > >
> > > auth [default=1 success=ok] pam_localuser.so
> > >
> > > before the lines below. This will call pam_unix only for users from
> > > /etc/passwd and skip the line it otherwise (default=1). Maybe
> something
> > > like this would help on Ubuntu as well?
> > >
> > > bye,
> > > Sumit
> > >
> > > >
> > > > auth [success=done ignore=ignore default=die] pam_unix.so
> nullok
> > > > try_first_pass
> > > > auth requisite pam_succeed_if.so uid >= 1000
> quiet_success
> > > > auth sufficient pam_sss.so forward_pass
> > > >
> > > > and in Ubuntu common-auth it is:
> > > >
> > > > auth [success=2 default=ignore] pam_unix.so nullok_secure
> > > > auth [success=1 default=ignore] pam_sss.so use_first_pass
> > > >
> > > > I tried reversing the lines and get a pam error about user not know
> (it
> > > is
> > > > an AD user which works fine on fedora).
> > > >
> > > > Also, it looks like pam_pkcs11.so is used in smartcard-auth on
> Fedora.
> > > > Don't know if this is relevant or not.
> > > >
> > > > Steve
> > > >
> > > >
> > > > On Thu, Sep 28, 2017 at 11:40 AM, Sumit Bose via FreeIPA-users <
> > > > freeipa-users(a)lists.fedorahosted.org> wrote:
> > > >
> > > > > On Thu, Sep 28, 2017 at 11:29:27AM -0400, Steve Weeks via
> FreeIPA-users
> > > > > wrote:
> > > > > > We have smartcards (PIV) working just fine on Fedora 25
with
> FreeIPA
> > > > > client
> > > > > > version 4.4.4 (SSSD 1.14.2). However on Ubuntu 16.04,
FreeIPA
> client
> > > > > > 4.3.1, SSSD 1.13.4 the smartcard seems to be ignored.
> > > > > >
> > > > > > The smartcard is readable using pkcs11-tools and
pkcs15-tools
> on both
> > > > > > systems.
> > > > > >
> > > > > > On both systems sssd.conf contains:
> > > > > > [pam]
> > > > > > pam_cert_auth = True
> > > > > >
> > > > > > I've turned the sssd logging up to 9 on both systems and
it
> looks
> > > like
> > > > > > p11_child is never called on the Ubuntu system. On the
Ubuntu
> system
> > > > > > p11_child.log is empty and there is no sign of it being
started
> in
> > > the
> > > > > > sssd_pam.log.
> > > > > >
> > > > > > Any suggestions on what I should look at next?
> > > > >
> > > > > How does your PAM configuration looks like? You have to make
sure
> that
> > > > > pam_sss.so is the first module called for SSSD users. If
pam_unix
> comes
> > > > > first it will ask for a Password and pass it on to pam_sss.so
> which
> > > will
> > > > > try password authentication in this case.
> > > > >
> > > > > HTH
> > > > >
> > > > > bye,
> > > > > Sumit
> > > > >
> > > > > >
> > > > > > Thanks,
> > > > > > Steve
> > > > >
> > > > > > _______________________________________________
> > > > > > FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahost
> ed.org
> > > > > > To unsubscribe send an email to freeipa-users-leave@lists.
> > > > > fedorahosted.org
> > > > > _______________________________________________
> > > > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahost
> ed.org
> > > > > To unsubscribe send an email to freeipa-users-leave@lists.
> > > fedorahosted.org
> > > > >
> > >
>
1:47 p.m.
On Thu, Oct 05, 2017 at 02:14:57PM -0400, Steve Weeks wrote:
The problem is definitely in sss_pam. From the logs, it sounds like
it
can't get the certificate from the server.
p11_child works the same on both Fedora 25 and Ubuntu 16.04 in both
pre-auth and auth mode. To run in auth mode, change the command line to:
echo PIN | /usr/libexec/sssd/p11_child -d 10 --debug-fd=1
--nssdb=/etc/pki/nssdb --auth --pin
Running from the command line, both Fedora and Ubuntu return the same
results in either mode.
On Ubuntu running a real login, auth mode is never called. The
sssd_pam.log files are different. I've attached the full logs, but this is
what seems to be the problem.
Fedora, which works fine:
[sss_dp_issue_request] (0x0400): Issuing request for
[0x55e4aeaaa710:8:MIIHdjCCBV6gAwIBAgIT..
[sss_dp_get_account_msg] (0x0400): Creating request for [ipa.example.com][
*0x14][BE_REQ_BY_CERT*][1][cert=MIIHdjCCBV...
[sss_dp_internal_get_send] (0x0400): Entering request
[0x55e4aeaaa710:8:MIIHdjCCBV6gA.......
[cache_req_cache_search] (0x0040): Cache Request [User by certificate #0]:
Cannot find info for [CERT:S/kgorJq32@ipa.example.com]
[child_sig_handler] (0x1000): Waiting for child [5701].
[child_sig_handler] (0x0100): child [5701] finished successfully.
[sbus_remove_timeout] (0x2000): 0x55e4afa97210
[sbus_dispatch] (0x4000): dbus conn: 0x55e4afa9e7d0
[sbus_dispatch] (0x4000): Dispatching.
[sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code:
0 errno: 0 error message: Success
The same sequence in Ubuntu has a different call parameter and seems to
fail:
[sss_dp_issue_request] (0x0400): Issuing request for
[0x410090:8:MIIHdjCCBV6...
[sss_dp_get_account_msg] (0x0400): Creating request for
[ipa.example.com][*0x1014][FAST
BE_REQ_BY_CERT*][1][cert=MIIHdjCCBV6gAw...
[sbus_add_timeout] (0x2000): 0xc46200
[sss_dp_internal_get_send] (0x0400): Entering request
[0x410090:8:MIIHdjCCBV6g.....
[child_sig_handler] (0x1000): Waiting for child [9758].
[child_sig_handler] (0x0100): child [9758] finished successfully.
[sbus_remove_timeout] (0x2000): 0xc46200
[sssd[pam]] [sbus_dispatch] (0x4000): dbus conn: 0xc1a220
[sbus_dispatch] (0x4000): Dispatching.
[sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code:
3 errno: 0 error message: Account info lookup failed
Fedora is running sssd 1.14.2 and Ubuntu is running 1.13.4. The user is
from an AD trust. Both systems are attached to the same IPA server.
How did you map the certificate to the AD users? Did you create an
idoverride for the AD user and add the certificate to the override?
Unfortunately this is only supported since sssd-1.14.
bye,
Sumit
Is there some configuration change that will make the Ubuntu system behave
like the Fedora system? I'd really like to use the standard Ubuntu
distribution.
Thanks,
Steve
On Fri, Sep 29, 2017 at 11:17 AM, Steve Weeks <nbxsteve(a)gmail.com> wrote:
> That works, but it is only pre-auth mode. In --auth mode it fails, but I
> don't think that relevant since fails the same way on Fedora too.
>
> The problems seems to be that on Ubuntu, --auth mode is never called. On
> Fedora p11_child is called twice. Once with --pre and then a second time
> with --auth. In the log you see:
>
> $ egrep 'main|verified' p11_child.log
> (Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main] (0x0400):
> p11_child started.
> (Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main] (0x2000):
> Running in [pre-auth] mode.
> (Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main] (0x2000):
> Running with effective IDs: [0][0].
> (Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main] (0x2000):
> Running with real IDs [0][0].
> (Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main] (0x0400):
> p11_child started.
> (Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main] (0x2000):
> Running in [auth] mode.
> (Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main] (0x2000):
> Running with effective IDs: [0][0].
> (Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main] (0x2000):
> Running with real IDs [0][0].
> (Thu Sep 28 14:23:23 2017) [[sssd[p11_child[15378]]]] [do_work] (0x4000):
> Certificate verified and validated.
>
> I've trimmed the log to what (I think) was interesting. I can send
> everything if you need it.
>
> For Ubuntu, the log stops after the first invocation of p11_child and you
> never see the [auth] mode call. Otherwise the logs are the same.
>
> Steve
>
>
> On Fri, Sep 29, 2017 at 3:17 AM, Sumit Bose <sbose(a)redhat.com> wrote:
>
>> On Thu, Sep 28, 2017 at 02:35:55PM -0400, Steve Weeks wrote:
>> > Progress, but still not using the smartcard and falling back to the
>> > password.
>> >
>> > I changed to change the pam_sss line in common-auth too:
>> >
>> > auth [default=1 success=ok] pam_localuser.so
>> > auth [success=2 default=ignore] pam_unix.so nullok_secure
>> > #auth [success=1 default=ignore] pam_sss.so use_first_pass
>> > auth sufficient pam_sss.so forward_pass
>> >
>> > Now p11_child is called, but doesn't validate the certificate. On
>> Fedora
>> > the final line in p11_child.log is "Ceritificate verified and
>> validated".
>> > On Ubuntu that line is missing.
>> >
>> > The root certificate is in the certdb. (certutil -d /etc/pki/nssdb -L).
>> >
>> > Is there a way to do what p11_child does from the command line or with
>> > better logging so I can what it doesn't like? I have debug_level = 9
on
>> > everything at the moment.
>>
>> /usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --pre
>> --nssdb=/etc/pki/nssdb
>>
>> should do the trick.
>>
>> HTH
>>
>> bye,
>> Sumit
>>
>> >
>> > Thanks,
>> > Steve
>> >
>> >
>> > On Thu, Sep 28, 2017 at 12:43 PM, Sumit Bose <sbose(a)redhat.com>
wrote:
>> >
>> > > On Thu, Sep 28, 2017 at 12:13:38PM -0400, Steve Weeks wrote:
>> > > > In all cases on both system pam_unix comes before pam_sss. For
>> example
>> > > in
>> > > > Fedora system-auth it is:
>> > >
>> > > On recent Fedora systems you should have
>> > >
>> > > auth [default=1 success=ok] pam_localuser.so
>> > >
>> > > before the lines below. This will call pam_unix only for users from
>> > > /etc/passwd and skip the line it otherwise (default=1). Maybe
>> something
>> > > like this would help on Ubuntu as well?
>> > >
>> > > bye,
>> > > Sumit
>> > >
>> > > >
>> > > > auth [success=done ignore=ignore default=die] pam_unix.so
>> nullok
>> > > > try_first_pass
>> > > > auth requisite pam_succeed_if.so uid >= 1000
>> quiet_success
>> > > > auth sufficient pam_sss.so forward_pass
>> > > >
>> > > > and in Ubuntu common-auth it is:
>> > > >
>> > > > auth [success=2 default=ignore] pam_unix.so nullok_secure
>> > > > auth [success=1 default=ignore] pam_sss.so use_first_pass
>> > > >
>> > > > I tried reversing the lines and get a pam error about user not
know
>> (it
>> > > is
>> > > > an AD user which works fine on fedora).
>> > > >
>> > > > Also, it looks like pam_pkcs11.so is used in smartcard-auth on
>> Fedora.
>> > > > Don't know if this is relevant or not.
>> > > >
>> > > > Steve
>> > > >
>> > > >
>> > > > On Thu, Sep 28, 2017 at 11:40 AM, Sumit Bose via FreeIPA-users
<
>> > > > freeipa-users(a)lists.fedorahosted.org> wrote:
>> > > >
>> > > > > On Thu, Sep 28, 2017 at 11:29:27AM -0400, Steve Weeks via
>> FreeIPA-users
>> > > > > wrote:
>> > > > > > We have smartcards (PIV) working just fine on Fedora 25
with
>> FreeIPA
>> > > > > client
>> > > > > > version 4.4.4 (SSSD 1.14.2). However on Ubuntu 16.04,
FreeIPA
>> client
>> > > > > > 4.3.1, SSSD 1.13.4 the smartcard seems to be ignored.
>> > > > > >
>> > > > > > The smartcard is readable using pkcs11-tools and
pkcs15-tools
>> on both
>> > > > > > systems.
>> > > > > >
>> > > > > > On both systems sssd.conf contains:
>> > > > > > [pam]
>> > > > > > pam_cert_auth = True
>> > > > > >
>> > > > > > I've turned the sssd logging up to 9 on both
systems and it
>> looks
>> > > like
>> > > > > > p11_child is never called on the Ubuntu system. On the
Ubuntu
>> system
>> > > > > > p11_child.log is empty and there is no sign of it being
started
>> in
>> > > the
>> > > > > > sssd_pam.log.
>> > > > > >
>> > > > > > Any suggestions on what I should look at next?
>> > > > >
>> > > > > How does your PAM configuration looks like? You have to make
sure
>> that
>> > > > > pam_sss.so is the first module called for SSSD users. If
pam_unix
>> comes
>> > > > > first it will ask for a Password and pass it on to
pam_sss.so
>> which
>> > > will
>> > > > > try password authentication in this case.
>> > > > >
>> > > > > HTH
>> > > > >
>> > > > > bye,
>> > > > > Sumit
>> > > > >
>> > > > > >
>> > > > > > Thanks,
>> > > > > > Steve
>> > > > >
>> > > > > > _______________________________________________
>> > > > > > FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahost
>> ed.org
>> > > > > > To unsubscribe send an email to
freeipa-users-leave@lists.
>> > > > > fedorahosted.org
>> > > > > _______________________________________________
>> > > > > FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahost
>> ed.org
>> > > > > To unsubscribe send an email to freeipa-users-leave@lists.
>> > > fedorahosted.org
>> > > > >
>> > >
>>
>
>
1:55 p.m.
No. The user is just in a group that is mapped between AD and IPA. Pretty
vanilla, just like the examples.
Steve
On Thu, Oct 5, 2017 at 2:47 PM, Sumit Bose <sbose(a)redhat.com> wrote:
On Thu, Oct 05, 2017 at 02:14:57PM -0400, Steve Weeks wrote:
> The problem is definitely in sss_pam. From the logs, it sounds like it
> can't get the certificate from the server.
>
> p11_child works the same on both Fedora 25 and Ubuntu 16.04 in both
> pre-auth and auth mode. To run in auth mode, change the command line to:
>
> echo PIN | /usr/libexec/sssd/p11_child -d 10 --debug-fd=1
> --nssdb=/etc/pki/nssdb --auth --pin
>
> Running from the command line, both Fedora and Ubuntu return the same
> results in either mode.
>
> On Ubuntu running a real login, auth mode is never called. The
> sssd_pam.log files are different. I've attached the full logs, but this
is
> what seems to be the problem.
>
> Fedora, which works fine:
>
> [sss_dp_issue_request] (0x0400): Issuing request for
> [0x55e4aeaaa710:8:MIIHdjCCBV6gAwIBAgIT..
> [sss_dp_get_account_msg] (0x0400): Creating request for [ipa.example.com
][
> *0x14][BE_REQ_BY_CERT*][1][cert=MIIHdjCCBV...
> [sss_dp_internal_get_send] (0x0400): Entering request
> [0x55e4aeaaa710:8:MIIHdjCCBV6gA.......
> [cache_req_cache_search] (0x0040): Cache Request [User by certificate
#0]:
> Cannot find info for [CERT:S/kgorJq32@ipa.example.com]
> [child_sig_handler] (0x1000): Waiting for child [5701].
> [child_sig_handler] (0x0100): child [5701] finished successfully.
> [sbus_remove_timeout] (0x2000): 0x55e4afa97210
> [sbus_dispatch] (0x4000): dbus conn: 0x55e4afa9e7d0
> [sbus_dispatch] (0x4000): Dispatching.
> [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error
code:
> 0 errno: 0 error message: Success
>
> The same sequence in Ubuntu has a different call parameter and seems to
> fail:
>
> [sss_dp_issue_request] (0x0400): Issuing request for
> [0x410090:8:MIIHdjCCBV6...
> [sss_dp_get_account_msg] (0x0400): Creating request for
> [ipa.example.com][*0x1014][FAST
> BE_REQ_BY_CERT*][1][cert=MIIHdjCCBV6gAw...
> [sbus_add_timeout] (0x2000): 0xc46200
> [sss_dp_internal_get_send] (0x0400): Entering request
> [0x410090:8:MIIHdjCCBV6g.....
> [child_sig_handler] (0x1000): Waiting for child [9758].
> [child_sig_handler] (0x0100): child [9758] finished successfully.
> [sbus_remove_timeout] (0x2000): 0xc46200
> [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn: 0xc1a220
> [sbus_dispatch] (0x4000): Dispatching.
> [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error
code:
> 3 errno: 0 error message: Account info lookup failed
>
> Fedora is running sssd 1.14.2 and Ubuntu is running 1.13.4. The user is
> from an AD trust. Both systems are attached to the same IPA server.
How did you map the certificate to the AD users? Did you create an
idoverride for the AD user and add the certificate to the override?
Unfortunately this is only supported since sssd-1.14.
bye,
Sumit
>
> Is there some configuration change that will make the Ubuntu system
behave
> like the Fedora system? I'd really like to use the standard Ubuntu
> distribution.
>
> Thanks,
> Steve
>
>
> On Fri, Sep 29, 2017 at 11:17 AM, Steve Weeks <nbxsteve(a)gmail.com>
wrote:
>
> > That works, but it is only pre-auth mode. In --auth mode it fails,
but I
> > don't think that relevant since fails the same way on Fedora too.
> >
> > The problems seems to be that on Ubuntu, --auth mode is never called.
On
> > Fedora p11_child is called twice. Once with --pre and then a second
time
> > with --auth. In the log you see:
> >
> > $ egrep 'main|verified' p11_child.log
> > (Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main] (0x0400):
> > p11_child started.
> > (Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main] (0x2000):
> > Running in [pre-auth] mode.
> > (Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main] (0x2000):
> > Running with effective IDs: [0][0].
> > (Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main] (0x2000):
> > Running with real IDs [0][0].
> > (Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main] (0x0400):
> > p11_child started.
> > (Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main] (0x2000):
> > Running in [auth] mode.
> > (Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main] (0x2000):
> > Running with effective IDs: [0][0].
> > (Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main] (0x2000):
> > Running with real IDs [0][0].
> > (Thu Sep 28 14:23:23 2017) [[sssd[p11_child[15378]]]] [do_work]
(0x4000):
> > Certificate verified and validated.
> >
> > I've trimmed the log to what (I think) was interesting. I can send
> > everything if you need it.
> >
> > For Ubuntu, the log stops after the first invocation of p11_child and
you
> > never see the [auth] mode call. Otherwise the logs are the same.
> >
> > Steve
> >
> >
> > On Fri, Sep 29, 2017 at 3:17 AM, Sumit Bose <sbose(a)redhat.com> wrote:
> >
> >> On Thu, Sep 28, 2017 at 02:35:55PM -0400, Steve Weeks wrote:
> >> > Progress, but still not using the smartcard and falling back to the
> >> > password.
> >> >
> >> > I changed to change the pam_sss line in common-auth too:
> >> >
> >> > auth [default=1 success=ok] pam_localuser.so
> >> > auth [success=2 default=ignore] pam_unix.so nullok_secure
> >> > #auth [success=1 default=ignore] pam_sss.so use_first_pass
> >> > auth sufficient pam_sss.so forward_pass
> >> >
> >> > Now p11_child is called, but doesn't validate the certificate.
On
> >> Fedora
> >> > the final line in p11_child.log is "Ceritificate verified and
> >> validated".
> >> > On Ubuntu that line is missing.
> >> >
> >> > The root certificate is in the certdb. (certutil -d /etc/pki/nssdb
-L).
> >> >
> >> > Is there a way to do what p11_child does from the command line or
with
> >> > better logging so I can what it doesn't like? I have debug_level
=
9 on
> >> > everything at the moment.
> >>
> >> /usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --pre
> >> --nssdb=/etc/pki/nssdb
> >>
> >> should do the trick.
> >>
> >> HTH
> >>
> >> bye,
> >> Sumit
> >>
> >> >
> >> > Thanks,
> >> > Steve
> >> >
> >> >
> >> > On Thu, Sep 28, 2017 at 12:43 PM, Sumit Bose <sbose(a)redhat.com>
wrote:
> >> >
> >> > > On Thu, Sep 28, 2017 at 12:13:38PM -0400, Steve Weeks wrote:
> >> > > > In all cases on both system pam_unix comes before pam_sss.
For
> >> example
> >> > > in
> >> > > > Fedora system-auth it is:
> >> > >
> >> > > On recent Fedora systems you should have
> >> > >
> >> > > auth [default=1 success=ok] pam_localuser.so
> >> > >
> >> > > before the lines below. This will call pam_unix only for users
from
> >> > > /etc/passwd and skip the line it otherwise (default=1). Maybe
> >> something
> >> > > like this would help on Ubuntu as well?
> >> > >
> >> > > bye,
> >> > > Sumit
> >> > >
> >> > > >
> >> > > > auth [success=done ignore=ignore default=die]
pam_unix.so
> >> nullok
> >> > > > try_first_pass
> >> > > > auth requisite pam_succeed_if.so uid >= 1000
> >> quiet_success
> >> > > > auth sufficient pam_sss.so forward_pass
> >> > > >
> >> > > > and in Ubuntu common-auth it is:
> >> > > >
> >> > > > auth [success=2 default=ignore] pam_unix.so nullok_secure
> >> > > > auth [success=1 default=ignore] pam_sss.so use_first_pass
> >> > > >
> >> > > > I tried reversing the lines and get a pam error about user
not
know
> >> (it
> >> > > is
> >> > > > an AD user which works fine on fedora).
> >> > > >
> >> > > > Also, it looks like pam_pkcs11.so is used in smartcard-auth
on
> >> Fedora.
> >> > > > Don't know if this is relevant or not.
> >> > > >
> >> > > > Steve
> >> > > >
> >> > > >
> >> > > > On Thu, Sep 28, 2017 at 11:40 AM, Sumit Bose via
FreeIPA-users <
> >> > > > freeipa-users(a)lists.fedorahosted.org> wrote:
> >> > > >
> >> > > > > On Thu, Sep 28, 2017 at 11:29:27AM -0400, Steve Weeks
via
> >> FreeIPA-users
> >> > > > > wrote:
> >> > > > > > We have smartcards (PIV) working just fine on
Fedora 25 with
> >> FreeIPA
> >> > > > > client
> >> > > > > > version 4.4.4 (SSSD 1.14.2). However on Ubuntu
16.04,
FreeIPA
> >> client
> >> > > > > > 4.3.1, SSSD 1.13.4 the smartcard seems to be
ignored.
> >> > > > > >
> >> > > > > > The smartcard is readable using pkcs11-tools and
pkcs15-tools
> >> on both
> >> > > > > > systems.
> >> > > > > >
> >> > > > > > On both systems sssd.conf contains:
> >> > > > > > [pam]
> >> > > > > > pam_cert_auth = True
> >> > > > > >
> >> > > > > > I've turned the sssd logging up to 9 on both
systems and it
> >> looks
> >> > > like
> >> > > > > > p11_child is never called on the Ubuntu system.
On the
Ubuntu
> >> system
> >> > > > > > p11_child.log is empty and there is no sign of it
being
started
> >> in
> >> > > the
> >> > > > > > sssd_pam.log.
> >> > > > > >
> >> > > > > > Any suggestions on what I should look at next?
> >> > > > >
> >> > > > > How does your PAM configuration looks like? You have to
make
sure
> >> that
> >> > > > > pam_sss.so is the first module called for SSSD users.
If
pam_unix
> >> comes
> >> > > > > first it will ask for a Password and pass it on to
pam_sss.so
> >> which
> >> > > will
> >> > > > > try password authentication in this case.
> >> > > > >
> >> > > > > HTH
> >> > > > >
> >> > > > > bye,
> >> > > > > Sumit
> >> > > > >
> >> > > > > >
> >> > > > > > Thanks,
> >> > > > > > Steve
> >> > > > >
> >> > > > > > _______________________________________________
> >> > > > > > FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahost
> >> ed.org
> >> > > > > > To unsubscribe send an email to
freeipa-users-leave@lists.
> >> > > > > fedorahosted.org
> >> > > > > _______________________________________________
> >> > > > > FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahost
> >> ed.org
> >> > > > > To unsubscribe send an email to
freeipa-users-leave@lists.
> >> > > fedorahosted.org
> >> > > > >
> >> > >
> >>
> >
> >
2:02 p.m.
On Thu, Oct 05, 2017 at 02:55:19PM -0400, Steve Weeks wrote:
No. The user is just in a group that is mapped between AD and IPA.
Pretty
vanilla, just like the examples.
But this is not related to Smartcard authentication. Can you send me the
fully sssd_your.domain.log files from Fedora and Ubuntu with
debug_level=10 in the [domain/...] section of sssd.conf? Feel free to
send them to me directly if you do not want to share them on the list.
bye,
Sumit
>
> Steve
>
>
> On Thu, Oct 5, 2017 at 2:47 PM, Sumit Bose <sbose(a)redhat.com> wrote:
>
> > On Thu, Oct 05, 2017 at 02:14:57PM -0400, Steve Weeks wrote:
> > > The problem is definitely in sss_pam. From the logs, it sounds like it
> > > can't get the certificate from the server.
> > >
> > > p11_child works the same on both Fedora 25 and Ubuntu 16.04 in both
> > > pre-auth and auth mode. To run in auth mode, change the command line to:
> > >
> > > echo PIN | /usr/libexec/sssd/p11_child -d 10 --debug-fd=1
> > > --nssdb=/etc/pki/nssdb --auth --pin
> > >
> > > Running from the command line, both Fedora and Ubuntu return the same
> > > results in either mode.
> > >
> > > On Ubuntu running a real login, auth mode is never called. The
> > > sssd_pam.log files are different. I've attached the full logs, but
this
> > is
> > > what seems to be the problem.
> > >
> > > Fedora, which works fine:
> > >
> > > [sss_dp_issue_request] (0x0400): Issuing request for
> > > [0x55e4aeaaa710:8:MIIHdjCCBV6gAwIBAgIT..
> > > [sss_dp_get_account_msg] (0x0400): Creating request for [ipa.example.com
> > ][
> > > *0x14][BE_REQ_BY_CERT*][1][cert=MIIHdjCCBV...
> > > [sss_dp_internal_get_send] (0x0400): Entering request
> > > [0x55e4aeaaa710:8:MIIHdjCCBV6gA.......
> > > [cache_req_cache_search] (0x0040): Cache Request [User by certificate
> > #0]:
> > > Cannot find info for [CERT:S/kgorJq32@ipa.example.com]
> > > [child_sig_handler] (0x1000): Waiting for child [5701].
> > > [child_sig_handler] (0x0100): child [5701] finished successfully.
> > > [sbus_remove_timeout] (0x2000): 0x55e4afa97210
> > > [sbus_dispatch] (0x4000): dbus conn: 0x55e4afa9e7d0
> > > [sbus_dispatch] (0x4000): Dispatching.
> > > [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error
> > code:
> > > 0 errno: 0 error message: Success
> > >
> > > The same sequence in Ubuntu has a different call parameter and seems to
> > > fail:
> > >
> > > [sss_dp_issue_request] (0x0400): Issuing request for
> > > [0x410090:8:MIIHdjCCBV6...
> > > [sss_dp_get_account_msg] (0x0400): Creating request for
> > > [ipa.example.com][*0x1014][FAST
> > > BE_REQ_BY_CERT*][1][cert=MIIHdjCCBV6gAw...
> > > [sbus_add_timeout] (0x2000): 0xc46200
> > > [sss_dp_internal_get_send] (0x0400): Entering request
> > > [0x410090:8:MIIHdjCCBV6g.....
> > > [child_sig_handler] (0x1000): Waiting for child [9758].
> > > [child_sig_handler] (0x0100): child [9758] finished successfully.
> > > [sbus_remove_timeout] (0x2000): 0xc46200
> > > [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn: 0xc1a220
> > > [sbus_dispatch] (0x4000): Dispatching.
> > > [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error
> > code:
> > > 3 errno: 0 error message: Account info lookup failed
> > >
> > > Fedora is running sssd 1.14.2 and Ubuntu is running 1.13.4. The user is
> > > from an AD trust. Both systems are attached to the same IPA server.
> >
> > How did you map the certificate to the AD users? Did you create an
> > idoverride for the AD user and add the certificate to the override?
> > Unfortunately this is only supported since sssd-1.14.
> >
> > bye,
> > Sumit
> >
> > >
> > > Is there some configuration change that will make the Ubuntu system
> > behave
> > > like the Fedora system? I'd really like to use the standard Ubuntu
> > > distribution.
> > >
> > > Thanks,
> > > Steve
> > >
> > >
> > > On Fri, Sep 29, 2017 at 11:17 AM, Steve Weeks <nbxsteve(a)gmail.com>
> > wrote:
> > >
> > > > That works, but it is only pre-auth mode. In --auth mode it fails,
> > but I
> > > > don't think that relevant since fails the same way on Fedora too.
> > > >
> > > > The problems seems to be that on Ubuntu, --auth mode is never called.
> > On
> > > > Fedora p11_child is called twice. Once with --pre and then a second
> > time
> > > > with --auth. In the log you see:
> > > >
> > > > $ egrep 'main|verified' p11_child.log
> > > > (Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main]
(0x0400):
> > > > p11_child started.
> > > > (Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main]
(0x2000):
> > > > Running in [pre-auth] mode.
> > > > (Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main]
(0x2000):
> > > > Running with effective IDs: [0][0].
> > > > (Thu Sep 28 14:23:19 2017) [[sssd[p11_child[15375]]]] [main]
(0x2000):
> > > > Running with real IDs [0][0].
> > > > (Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main]
(0x0400):
> > > > p11_child started.
> > > > (Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main]
(0x2000):
> > > > Running in [auth] mode.
> > > > (Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main]
(0x2000):
> > > > Running with effective IDs: [0][0].
> > > > (Thu Sep 28 14:23:22 2017) [[sssd[p11_child[15378]]]] [main]
(0x2000):
> > > > Running with real IDs [0][0].
> > > > (Thu Sep 28 14:23:23 2017) [[sssd[p11_child[15378]]]] [do_work]
> > (0x4000):
> > > > Certificate verified and validated.
> > > >
> > > > I've trimmed the log to what (I think) was interesting. I can
send
> > > > everything if you need it.
> > > >
> > > > For Ubuntu, the log stops after the first invocation of p11_child and
> > you
> > > > never see the [auth] mode call. Otherwise the logs are the same.
> > > >
> > > > Steve
> > > >
> > > >
> > > > On Fri, Sep 29, 2017 at 3:17 AM, Sumit Bose <sbose(a)redhat.com>
wrote:
> > > >
> > > >> On Thu, Sep 28, 2017 at 02:35:55PM -0400, Steve Weeks wrote:
> > > >> > Progress, but still not using the smartcard and falling back
to the
> > > >> > password.
> > > >> >
> > > >> > I changed to change the pam_sss line in common-auth too:
> > > >> >
> > > >> > auth [default=1 success=ok] pam_localuser.so
> > > >> > auth [success=2 default=ignore] pam_unix.so nullok_secure
> > > >> > #auth [success=1 default=ignore] pam_sss.so use_first_pass
> > > >> > auth sufficient pam_sss.so
forward_pass
> > > >> >
> > > >> > Now p11_child is called, but doesn't validate the
certificate. On
> > > >> Fedora
> > > >> > the final line in p11_child.log is "Ceritificate
verified and
> > > >> validated".
> > > >> > On Ubuntu that line is missing.
> > > >> >
> > > >> > The root certificate is in the certdb. (certutil -d
/etc/pki/nssdb
> > -L).
> > > >> >
> > > >> > Is there a way to do what p11_child does from the command
line or
> > with
> > > >> > better logging so I can what it doesn't like? I have
debug_level =
> > 9 on
> > > >> > everything at the moment.
> > > >>
> > > >> /usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --pre
> > > >> --nssdb=/etc/pki/nssdb
> > > >>
> > > >> should do the trick.
> > > >>
> > > >> HTH
> > > >>
> > > >> bye,
> > > >> Sumit
> > > >>
> > > >> >
> > > >> > Thanks,
> > > >> > Steve
> > > >> >
> > > >> >
> > > >> > On Thu, Sep 28, 2017 at 12:43 PM, Sumit Bose
<sbose(a)redhat.com>
> > wrote:
> > > >> >
> > > >> > > On Thu, Sep 28, 2017 at 12:13:38PM -0400, Steve Weeks
wrote:
> > > >> > > > In all cases on both system pam_unix comes before
pam_sss. For
> > > >> example
> > > >> > > in
> > > >> > > > Fedora system-auth it is:
> > > >> > >
> > > >> > > On recent Fedora systems you should have
> > > >> > >
> > > >> > > auth [default=1 success=ok] pam_localuser.so
> > > >> > >
> > > >> > > before the lines below. This will call pam_unix only for
users
> > from
> > > >> > > /etc/passwd and skip the line it otherwise (default=1).
Maybe
> > > >> something
> > > >> > > like this would help on Ubuntu as well?
> > > >> > >
> > > >> > > bye,
> > > >> > > Sumit
> > > >> > >
> > > >> > > >
> > > >> > > > auth [success=done ignore=ignore
default=die] pam_unix.so
> > > >> nullok
> > > >> > > > try_first_pass
> > > >> > > > auth requisite pam_succeed_if.so uid
>= 1000
> > > >> quiet_success
> > > >> > > > auth sufficient pam_sss.so forward_pass
> > > >> > > >
> > > >> > > > and in Ubuntu common-auth it is:
> > > >> > > >
> > > >> > > > auth [success=2 default=ignore] pam_unix.so
nullok_secure
> > > >> > > > auth [success=1 default=ignore] pam_sss.so
use_first_pass
> > > >> > > >
> > > >> > > > I tried reversing the lines and get a pam error
about user not
> > know
> > > >> (it
> > > >> > > is
> > > >> > > > an AD user which works fine on fedora).
> > > >> > > >
> > > >> > > > Also, it looks like pam_pkcs11.so is used in
smartcard-auth on
> > > >> Fedora.
> > > >> > > > Don't know if this is relevant or not.
> > > >> > > >
> > > >> > > > Steve
> > > >> > > >
> > > >> > > >
> > > >> > > > On Thu, Sep 28, 2017 at 11:40 AM, Sumit Bose via
FreeIPA-users <
> > > >> > > > freeipa-users(a)lists.fedorahosted.org> wrote:
> > > >> > > >
> > > >> > > > > On Thu, Sep 28, 2017 at 11:29:27AM -0400,
Steve Weeks via
> > > >> FreeIPA-users
> > > >> > > > > wrote:
> > > >> > > > > > We have smartcards (PIV) working just
fine on Fedora 25 with
> > > >> FreeIPA
> > > >> > > > > client
> > > >> > > > > > version 4.4.4 (SSSD 1.14.2). However on
Ubuntu 16.04,
> > FreeIPA
> > > >> client
> > > >> > > > > > 4.3.1, SSSD 1.13.4 the smartcard seems to
be ignored.
> > > >> > > > > >
> > > >> > > > > > The smartcard is readable using
pkcs11-tools and
> > pkcs15-tools
> > > >> on both
> > > >> > > > > > systems.
> > > >> > > > > >
> > > >> > > > > > On both systems sssd.conf contains:
> > > >> > > > > > [pam]
> > > >> > > > > > pam_cert_auth = True
> > > >> > > > > >
> > > >> > > > > > I've turned the sssd logging up to 9
on both systems and it
> > > >> looks
> > > >> > > like
> > > >> > > > > > p11_child is never called on the Ubuntu
system. On the
> > Ubuntu
> > > >> system
> > > >> > > > > > p11_child.log is empty and there is no
sign of it being
> > started
> > > >> in
> > > >> > > the
> > > >> > > > > > sssd_pam.log.
> > > >> > > > > >
> > > >> > > > > > Any suggestions on what I should look at
next?
> > > >> > > > >
> > > >> > > > > How does your PAM configuration looks like?
You have to make
> > sure
> > > >> that
> > > >> > > > > pam_sss.so is the first module called for SSSD
users. If
> > pam_unix
> > > >> comes
> > > >> > > > > first it will ask for a Password and pass it
on to pam_sss.so
> > > >> which
> > > >> > > will
> > > >> > > > > try password authentication in this case.
> > > >> > > > >
> > > >> > > > > HTH
> > > >> > > > >
> > > >> > > > > bye,
> > > >> > > > > Sumit
> > > >> > > > >
> > > >> > > > > >
> > > >> > > > > > Thanks,
> > > >> > > > > > Steve
> > > >> > > > >
> > > >> > > > > >
_______________________________________________
> > > >> > > > > > FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahost
> > > >> ed.org
> > > >> > > > > > To unsubscribe send an email to
freeipa-users-leave@lists.
> > > >> > > > > fedorahosted.org
> > > >> > > > >
_______________________________________________
> > > >> > > > > FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahost
> > > >> ed.org
> > > >> > > > > To unsubscribe send an email to
freeipa-users-leave@lists.
> > > >> > > fedorahosted.org
> > > >> > > > >
> > > >> > >
> > > >>
> > > >
> > > >
> >
> >
> >
> >
> >
> >
2394
days inactive
2401
days old
freeipa-users@lists.fedorahosted.org
10 comments
2 participants
participants (2)
-
Steve Weeks -
Sumit Bose