Hi I deployed a third replica in a dmz network for clients that do not route to the main ipa masters. Not sure if this is a workable setup. I can join clients using --fixed-primary and can logon with AD (one-way trust). This third replica has the trust-agent role. I might be approaching this incorrectly. Posting here for advise, has anyone attepted this and how to approach? It seems to be working, except the sudo rules.
I have posted a diagram here: https://ibb.co/WkQj9yD
On Fri, 21 Jun 2024, slek kus via FreeIPA-users wrote:
Hi I deployed a third replica in a dmz network for clients that do not route to the main ipa masters. Not sure if this is a workable setup. I can join clients using --fixed-primary and can logon with AD (one-way trust). This third replica has the trust-agent role. I might be approaching this incorrectly. Posting here for advise, has anyone attepted this and how to approach? It seems to be working, except the sudo rules.
I have posted a diagram here: https://ibb.co/WkQj9yD
It would be best if you could provide actual logs, not pictures. And ideally those logs should come from both a client and a server.
Hi Alexander, posted the logs to pastebin, since it is quite some data. These logs are from the client only. debug_level = 6 Did a clear of cache, then logged onto the client with a trusted user (AD trust), then did a sudo -l.
pac, pam, sudo sssd logs here: https://pastebin.com/mcYJixXz
sssd_[domain] here: https://pastebin.com/Gy9B6MR8
After some more searching, I see that the client contacts the AD domain controller, asking for AAA record, then connects to the AD forest controller, which is _not_ reachable due to firewall filters. Does ipa-client always need to contact the root DC for a krb ticket (guess this is what is attempted here)?
freeipa-users@lists.fedorahosted.org
-
Alexander Bokovoy -
slek kus