12:20 a.m.
Hi,
I have RH's version of freeipa
(ipa-server-4.9.2-3.module+el8.4.0+10412+5ecb5b37.x86_64) working fine. RHEL8, RHEL7,
Debian10.9, Ubuntu20LTS and Centos7 clients work perfectly OK to IPA OK for users in
IPA..
For the cross domain trust however only RHEL8 and RHEL7 work. Debian10.9, Ubuntu20LTS and
Centos7 fail for the AD user who cannot ssh in..
Is there any config I need to do to get 3rd party Linux to work with a trust? Just
wondering if I have missed a package? config? steps?
or does it just not work?
rhel7 secure log showing success,
8><----
Jun 9 16:40:55 rhel7a sshd[9339]: pam_sss(sshd:auth): authentication success; logname=
uid=0 euid=0 tty=ssh ruser= rhost=v1.ods.vuw.ac.nz user=linuxuser2(a)vuwtest.ac.nz
Jun 9 16:41:04 rhel7a sshd[9336]: Accepted keyboard-interactive/pam for
linuxuser2(a)vuwtest.ac.nz from 10.100.32.67 port 48
Jun 9 16:41:04 rhel7a sshd[9336]: pam_unix(sshd:session): session opened for user
linuxuser2(a)vuwtest.ac.nz by (uid=0)
[root@rhel7a ~]#
8><---
centos7 secure log,
8><---
[root@centos7a ~]# tail -50f /var/log/secure
Jun 9 17:15:24 centos7a sshd[1812]: Invalid user linuxuser2(a)vuwtest.ac.nz from
10.100.32.67 port 53880
Jun 9 17:15:24 centos7a sshd[1812]: input_userauth_request: invalid user
linuxuser2(a)vuwtest.ac.nz [preauth]
Jun 9 17:15:24 centos7a sshd[1812]: Postponed keyboard-interactive for invalid user
linuxuser2(a)vuwtest.ac.nz from 10.100.32.67 port 53880 ssh2 [preauth]
Jun 9 17:15:35 centos7a sshd[1814]: pam_unix(sshd:auth): check pass; user unknown
Jun 9 17:15:35 centos7a sshd[1814]: pam_unix(sshd:auth): authentication failure; logname=
uid=0 euid=0 tty=ssh ruser= rhost=10.100.32.67
Jun 9 17:15:37 centos7a sshd[1812]: error: PAM: User not known to the underlying
authentication module for illegal user linuxuser2(a)vuwtest.ac.nz from 10.100.32.67
Jun 9 17:15:37 centos7a sshd[1812]: Failed keyboard-interactive/pam for invalid user
linuxuser2(a)vuwtest.ac.nz from 10.100.32.67 port 53880 ssh2
Jun 9 17:15:37 centos7a sshd[1812]: Postponed keyboard-interactive for invalid user
linuxuser2(a)vuwtest.ac.nz from 10.100.32.67 port 53880 ssh2 [preauth]
12:58 a.m.
New subject: Cross domain trust RH IdM to AD RHEL OK, other linux distro
problems
On 09/06/2021 13:20, thing.thing(a)gmail.com wrote:
I have RH's version of freeipa
(ipa-server-4.9.2-3.module+el8.4.0+10412+5ecb5b37.x86_64) working fine. RHEL8, RHEL7,
Debian10.9, Ubuntu20LTS and Centos7 clients work perfectly OK to IPA OK for users in
IPA..
For the cross domain trust however only RHEL8 and RHEL7 work. Debian10.9, Ubuntu20LTS
and Centos7 fail for the AD user who cannot ssh in..
Is there any config I need to do to get 3rd party Linux to work with a trust? Just
wondering if I have missed a package? config? steps?
May I suggest you post/ask on the dedicated freeipa list?
https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...
--
Remind me to ignore comments which aren't germane to the thread.
2:28 p.m.
New subject: Cross domain trust RH IdM to AD RHEL OK,
other linux distro problems
I thought I did, sorry. This platform isnt very clear where you are :(
4 p.m.
New subject: Cross domain trust RH IdM to AD RHEL OK, other linux distro
problems
On Wed, 2021-06-09 at 19:28 +0000, thing.thing(a)gmail.com wrote:
I thought I did, sorry. This platform isnt very clear where you
are
:(
You thought you did what? If you reply on HyperKitty there's no context
unless you explicitly quote it.
poc
4:40 p.m.
New subject: Cross domain trust RH IdM to AD RHEL OK, other linux distro
problems
On 10/06/2021 05:00, Patrick O'Callaghan wrote:
On Wed, 2021-06-09 at 19:28 +0000, thing.thing(a)gmail.com wrote:
> I thought I did, sorry. This platform isnt very clear where you are
> :(
You thought you did what? If you reply on HyperKitty there's no context
unless you explicitly quote it.
Lucky for me T-Bird sorts threads based on subject as well as header information.
Doesn't
Evolution?
Oh, he thought he posted on the freeIPA list.
--
Remind me to ignore comments which aren't germane to the thread.
5:14 p.m.
New subject: Cross domain trust RH IdM to AD RHEL OK, other linux distro
problems
09.06.21, 23:40 +0200, Ed Greshko:
On 10/06/2021 05:00, Patrick O'Callaghan wrote:
> On Wed, 2021-06-09 at 19:28 +0000, thing.thing(a)gmail.com wrote:
>> I thought I did, sorry. This platform isnt very clear where you are
>> :(
> You thought you did what? If you reply on HyperKitty there's no context
> unless you explicitly quote it.
>
Lucky for me T-Bird sorts threads based on subject as well as header information.
Doesn't
Evolution?
In this particular case no threading based on subject is necessary,
since thing.thing's reply contains usable "In-Reply-To" and
"References"
header fields.
--
Regards
mks
6:19 p.m.
New subject: Cross domain trust RH IdM to AD RHEL OK, other linux distro
problems
On 10/06/2021 06:14, Markus Schönhaber wrote:
09.06.21, 23:40 +0200, Ed Greshko:
> On 10/06/2021 05:00, Patrick O'Callaghan wrote:
>> On Wed, 2021-06-09 at 19:28 +0000, thing.thing(a)gmail.com wrote:
>>> I thought I did, sorry. This platform isnt very clear where you are
>>> :(
>> You thought you did what? If you reply on HyperKitty there's no context
>> unless you explicitly quote it.
>>
> Lucky for me T-Bird sorts threads based on subject as well as header information.
Doesn't
> Evolution?
In this particular case no threading based on subject is necessary,
since thing.thing's reply contains usable "In-Reply-To" and
"References"
header fields.
Good point. I had seen, probably too long ago, cases where HyperKitty had missed some
headers.
I should have looked and not "assumed".
Thanks.
--
Remind me to ignore comments which aren't germane to the thread.
10:15 p.m.
New subject: Cross domain trust RH IdM to AD RHEL OK, other linux distro
problems
Patrick O'Callaghan
> You thought you did what? If you reply on HyperKitty there's
no
> context unless you explicitly quote it.
Ed Greshko:
Lucky for me T-Bird sorts threads based on subject as well as header
information. Doesn't Evolution?
It does. I'm using it.
Though he's right that replies should give an unmistakeable clue about
what's being replied to. It makes it far easier to understand if you
don't have to find a prior message to understand it. And some people
delete old messages, especially when they're inundated with hundreds
each day.
On Evolution, I have it only showing the last 5 day's worth. If it
were easily customisable, I might narrow it down to 3 day's worth.
Back when I did usenet using Forte Agent, I recall doing something
similar, with it auto-deleting cached messages that were a couple of
weeks old. At least with usenet, you could very easily re-fetch an
older uncached message (you still saw the headers, you just didn't have
any cached body content for them).
--
uname -rsvp
Linux 3.10.0-1160.25.1.el7.x86_64 #1 SMP Wed Apr 28 21:49:45 UTC 2021 x86_64
Boilerplate: All unexpected mail to my mailbox is automatically deleted.
I will only get to see the messages that are posted to the mailing list.
10:36 p.m.
New subject: Cross domain trust RH IdM to AD RHEL OK, other linux distro
problems
On 10/06/2021 11:15, Tim via users wrote:
Though he's right that replies should give an unmistakeable clue
about
what's being replied to. It makes it far easier to understand if you
don't have to find a prior message to understand it. And some people
delete old messages, especially when they're inundated with hundreds
each day.
I get a few hundred message a day. I use filters to folders which makes my life easier
when people
don't do what "I" think they should. :-) :-)
I keep 15 days of list emails locally. Just for those times where there are long
threads. Even now
the User's folder only has 202 emails in it. And it isn't as if I lack disk
space, but still.
On Evolution, I have it only showing the last 5 day's worth. If
it
were easily customisable, I might narrow it down to 3 day's worth.
T-Bird has a nice "Retention Policy" on a per folder basis.
Back when I did usenet using Forte Agent, I recall doing something
similar, with it auto-deleting cached messages that were a couple of
weeks old. At least with usenet, you could very easily re-fetch an
older uncached message (you still saw the headers, you just didn't have
any cached body content for them).
If someone posts a reply to messages which hss been deleted and I can't divine what
is being said I do one of 2 things. I either ignore it (especially if I'm weak on the
subject).
Or, I go to the archives. My browser has a bookmark to them so it isn't too much
trouble.
--
Remind me to ignore comments which aren't germane to the thread.
5:17 a.m.
New subject: Cross domain trust RH IdM to AD RHEL OK, other linux distro
problems
Tim:
> On Evolution, I have it only showing the last 5 day's worth.
If it
> were easily customisable, I might narrow it down to 3 day's worth.
Ed Greshko:
T-Bird has a nice "Retention Policy" on a per folder basis.
Evolution does have retention options, where old messages can be
deleted or archived if they're so-many days/weeks/months old, but the
filtering (what you see by default) per folder is a less flexible.
Over the years I've tried various clients, but they all suck very badly
at replying. Specifically, the mangling of quotes, and how well it'll
let you manually unmangle them. Forte Agent was the only client I've
come across that would edit properly like you were using a word
processor, and understand not to mangle up the greater-than signs being
used as quote prefixes into the middle of the text. Evolution was the
least-worst mail clients out of the Linux ones I've tried. Thunderbird
does a lot of weird stuff I just do not like.
This is an ugly manglification of your text that shouldn't happen, and
software should have been written to handle it better decades ago, that
I usually hand re-wrap, but I'm leaving it as an example:
If someone posts a reply to messages which hss been deleted and I
can't divine what
is being said I do one of 2 things. I either ignore it (especially
if I'm weak on the subject).
Or, I go to the archives. My browser has a bookmark to them so it
isn't too much trouble.
I'll just ignore it. If I have to fire up a browser and go searching
for it, it's too much effort. I won't be the only one who does that.
So people who make it hard to follow their messages are only shooting
themselves in the foot.
--
uname -rsvp
Linux 3.10.0-1160.25.1.el7.x86_64 #1 SMP Wed Apr 28 21:49:45 UTC 2021 x86_64
Boilerplate: All unexpected mail to my mailbox is automatically deleted.
I will only get to see the messages that are posted to the mailing list.
4:35 a.m.
New subject: Cross domain trust RH IdM to AD RHEL OK, other linux distro
problems
On Thu, 2021-06-10 at 05:40 +0800, Ed Greshko wrote:
On 10/06/2021 05:00, Patrick O'Callaghan wrote:
> On Wed, 2021-06-09 at 19:28 +0000, thing.thing(a)gmail.com wrote:
> > I thought I did, sorry. This platform isnt very clear where you
> > are
> > :(
> You thought you did what? If you reply on HyperKitty there's no
> context
> unless you explicitly quote it.
>
Lucky for me T-Bird sorts threads based on subject as well as header
information. Doesn't
Evolution?
Of course it does, but not everyone keeps threads around or has them
permanently visible once read. Quoting is useful to get an idea of what
the comment is about without having to look for the post being replied
to.
poc
4:59 a.m.
New subject: Cross domain trust RH IdM to AD RHEL OK, other linux distro
problems
On 10/06/2021 17:35, Patrick O'Callaghan wrote:
On Thu, 2021-06-10 at 05:40 +0800, Ed Greshko wrote:
> On 10/06/2021 05:00, Patrick O'Callaghan wrote:
>> On Wed, 2021-06-09 at 19:28 +0000, thing.thing(a)gmail.com wrote:
>>> I thought I did, sorry. This platform isnt very clear where you
>>> are
>>> :(
>> You thought you did what? If you reply on HyperKitty there's no
>> context
>> unless you explicitly quote it.
>>
> Lucky for me T-Bird sorts threads based on subject as well as header
> information. Doesn't
> Evolution?
>
Of course it does, but not everyone keeps threads around or has them
permanently visible once read. Quoting is useful to get an idea of what
the comment is about without having to look for the post being replied
to.
Oh, Tim had said "If it were easily customisable, I might narrow it down to 3
day's worth".
So I was wondering about it.
FWIW, my memory is still fairly good. I never recalled thing.thing posting to this list.
So, to me, it didn't make much sense to be admonishing them.
Kinda like responding to list spam. Just a waste of keystrokes. :-)
And, when will I ever follow the advice in my signature?
--
Remind me to ignore comments which aren't germane to the thread.
5:24 a.m.
New subject: Cross domain trust RH IdM to AD RHEL OK, other linux distro
problems
On Thu, 2021-06-10 at 17:59 +0800, Ed Greshko wrote:
FWIW, my memory is still fairly good. I never recalled thing.thing
posting to this list.
So, to me, it didn't make much sense to be admonishing them.
Kinda like responding to list spam. Just a waste of keystrokes. :-)
Perhaps not as good as you think Ed. The original post is:
https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.o...
poc
5:33 a.m.
New subject: Cross domain trust RH IdM to AD RHEL OK, other linux distro
problems
On 10/06/2021 18:24, Patrick O'Callaghan wrote:
On Thu, 2021-06-10 at 17:59 +0800, Ed Greshko wrote:
> FWIW, my memory is still fairly good. I never recalled thing.thing
> posting to this list.
> So, to me, it didn't make much sense to be admonishing them.
> Kinda like responding to list spam. Just a waste of keystrokes. :-)
Perhaps not as good as you think Ed. The original post is:
https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.o...
Ah, I was referring to prior to June 9th, if that wasn't obvious. Besides, I was the
one to have responded
to him about posting to the freeIPA list. So......
--
Remind me to ignore comments which aren't germane to the thread.
8:45 p.m.
New subject: Cross domain trust RH IdM to AD RHEL OK,
other linux distro problems
debian auth log errors
Jun 14 13:33:36 debian10-test1 sshd[14476]: Failed keyboard-interactive/pam for invalid
user linuxuser2(a)vuwtest.ac.nz from 1 0.120.248.104
port 61903 ssh2
Jun 14 13:33:36 debian10-test1 sshd[14476]: Postponed keyboard-interactive for invalid
user linuxuser2(a)vuwtest.ac.nz from 10 .120.248.104
port 61903 ssh2 [preauth]
Jun 14 13:33:40 debian10-test1 sshd[14479]: pam_unix(sshd:auth): check pass; user unknown
Jun 14 13:33:40 debian10-test1 sshd[14479]: pam_unix(sshd:auth): authentication failure;
logname= uid=0 euid=0 tty=ssh ruser =
rhost=10.120.248.104
Jun 14 13:33:40 debian10-test1 sshd[14479]: pam_sss(sshd:auth): authentication failure;
logname= uid=0 euid=0 tty=ssh ruser=
rhost=10.120.248.104 user=linuxuser2(a)vuwtest.ac.nz
Jun 14 13:33:40 debian10-test1 sshd[14479]: pam_sss(sshd:auth): received for user
linuxuser2(a)vuwtest.ac.nz: 10 (User not kno wn to the
underlying authentication module)
Jun 14 13:33:42 debian10-test1 sshd[14476]: error: PAM: Authentication failure for illegal
user linuxuser2(a)vuwtest.ac.nz fro m 10.120.248.104
Jun 14 13:33:42 debian10-test1 sshd[14476]: Failed keyboard-interactive/pam for invalid
user linuxuser2(a)vuwtest.ac.nz from 1 0.120.248.104
port 61903 ssh2
Jun 14 13:33:42 debian10-test1 sshd[14476]: Postponed keyboard-interactive for invalid
user linuxuser2(a)vuwtest.ac.nz from 10 .120.248.104
port 61903 ssh2 [preauth]
Jun 14 13:33:50 debian10-test1 sshd[14476]: Connection closed by invalid user
linuxuser2(a)vuwtest.ac.nz 10.120.248.104 port 6 1903
[preauth]
8:48 p.m.
New subject: Cross domain trust RH IdM to AD RHEL OK, other linux distro
problems
On 14/06/2021 09:45, thing.thing(a)gmail.com wrote:
Wrong list again? :-)
debian auth log errors
Jun 14 13:33:36 debian10-test1 sshd[14476]: Failed keyboard-interactive/pam for invalid
user linuxuser2(a)vuwtest.ac.nz from 1 0.120.248.104
port 61903 ssh2
Jun 14 13:33:36 debian10-test1 sshd[14476]: Postponed keyboard-interactive for invalid
user linuxuser2(a)vuwtest.ac.nz from 10 .120.248.104
port 61903 ssh2 [preauth]
Jun 14 13:33:40 debian10-test1 sshd[14479]: pam_unix(sshd:auth): check pass; user
unknown
Jun 14 13:33:40 debian10-test1 sshd[14479]: pam_unix(sshd:auth): authentication failure;
logname= uid=0 euid=0 tty=ssh ruser =
rhost=10.120.248.104
Jun 14 13:33:40 debian10-test1 sshd[14479]: pam_sss(sshd:auth): authentication failure;
logname= uid=0 euid=0 tty=ssh ruser=
rhost=10.120.248.104 user=linuxuser2(a)vuwtest.ac.nz
Jun 14 13:33:40 debian10-test1 sshd[14479]: pam_sss(sshd:auth): received for user
linuxuser2(a)vuwtest.ac.nz: 10 (User not kno wn to the
underlying authentication module)
Jun 14 13:33:42 debian10-test1 sshd[14476]: error: PAM: Authentication failure for
illegal user linuxuser2(a)vuwtest.ac.nz fro m
10.120.248.104
Jun 14 13:33:42 debian10-test1 sshd[14476]: Failed keyboard-interactive/pam for invalid
user linuxuser2(a)vuwtest.ac.nz from 1 0.120.248.104
port 61903 ssh2
Jun 14 13:33:42 debian10-test1 sshd[14476]: Postponed keyboard-interactive for invalid
user linuxuser2(a)vuwtest.ac.nz from 10 .120.248.104
port 61903 ssh2 [preauth]
Jun 14 13:33:50 debian10-test1 sshd[14476]: Connection closed by invalid user
linuxuser2(a)vuwtest.ac.nz 10.120.248.104 port 6 1903
[preauth]
_______________________________________________
users mailing list -- users(a)lists.fedoraproject.org
To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
--
Remind me to ignore comments which aren't germane to the thread.
1047
days inactive
1052
days old
16 comments
5 participants
participants (5)
-
Ed Greshko -
Markus Schönhaber -
Patrick O'Callaghan -
thing.thing＠gmail.com -
Tim