Platform is a fully-updated CentOS 7 instance. I have installed ipa-server-4.6.8-5.el7.centos.9.x86_64 and all the dependent packages.
The RedHat documentation tells you to use a script that sets all passwords to the same fixed string, however, I would like to use the hashed passwords from my NIS instance. The NIS server passwrod policy is set to "sha512".
I have set: ipa config-mod --enable-migration=true
It appears that the RedHat build does not allow encrypted passwords with "ipa user-mod", but I am trying to set the password with "ipa user-add". However, whenever I do this, attempting to test the login results in: kinit: Pre-authentication failed: Invalid argument while getting initial credentials
ipa user-add blahblah --first=NIS --last=USER --setattr 'userpassword={sha512}$6$WZktVggI$Rsmo.M31dUfgalp5e39a47FwjfdM5UA9UT1dwvKjrLJZVjh7SxG0g2SuDYOZmFM9mdGeTIz8KZpZukKouNQR1/' --uid=4444 --gid=444 --gecos='Blah' --homedir=/home/blah --shell=/bin/bash --------------------- Added user "blahblah" --------------------- User login: blahblah First name: NIS Last name: USER Full name: NIS USER Display name: NIS USER Initials: NU Home directory: /home/blah GECOS: Blah Login shell: /bin/bash Principal name: blahblah@SJ.BPS Principal alias: blahblah@SJ.BPS Email address: blahblah@sj.bps UID: 4444 GID: 444 Password: True Member of groups: ipausers Kerberos keys available: False [root@ipa1 ~]# kinit blahblah kinit: Pre-authentication failed: Invalid argument while getting initial credentials
It doesn't seem to matter what I specify for "{crypt}": md5 or sha512, I get the same message.
On pe, 17 joulu 2021, Simon Matthews via FreeIPA-users wrote:
Platform is a fully-updated CentOS 7 instance. I have installed ipa-server-4.6.8-5.el7.centos.9.x86_64 and all the dependent packages.
The RedHat documentation tells you to use a script that sets all passwords to the same fixed string, however, I would like to use the hashed passwords from my NIS instance. The NIS server passwrod policy is set to "sha512".
I have set: ipa config-mod --enable-migration=true
It appears that the RedHat build does not allow encrypted passwords with "ipa user-mod", but I am trying to set the password with "ipa user-add". However, whenever I do this, attempting to test the login results in: kinit: Pre-authentication failed: Invalid argument while getting initial credentials
That's correct. You have no Kerberos key associated with the entry, only (some) LDAP password hash.
In order to obtain a kerberos ticket, KDC needs to have own encryption keys for each user. During migration you don't have any until you'd attempt to authenticate over LDAP with a plain-text password.
When migration mode is enabled, SSSD notices it and attempts to authenticate to LDAP in case kinit fails. On LDAP authentication IPA LDAP plugins handle this by generating Kerberos encryption keys for this user account because now they have a plain-text password -- this happens after the plain-text password was successfully authenticated against existing LDAP password hash.
So you need to authenticate prior to be able to use Kerberos -- either by doing a login through SSSD PAM services (ssh with password, for example) or by directly doing LDAP authentication with a password.
Thanks for this clear explanation. What's the simplest way to test that I have properly imported the passwords?
On pe, 17 joulu 2021, Simon Matthews via FreeIPA-users wrote:
Thanks for this clear explanation. What's the simplest way to test that I have properly imported the passwords?
As I said in my response:
------------------- So you need to authenticate prior to be able to use Kerberos -- either by doing a login through SSSD PAM services (ssh with password, for example) or by directly doing LDAP authentication with a password. -------------------
Thanks for the help.
Unfortunately, I must have missed something: the password that I set with "setattr userpassword=<>" is not accepted.
I set up another VM, configured it using the ipa-client-install script, and I can do "su <username>" on the client, but both a ssh login of a "passwd" command fails on the password.
Should I have configured my ipa server to also be a NIS server for the transition? I see that the server has a yp.conf files that appear to have been configured when I configured the ipa server and client.
On la, 18 joulu 2021, Simon Matthews via FreeIPA-users wrote:
Thanks for the help.
Unfortunately, I must have missed something: the password that I set with "setattr userpassword=<>" is not accepted.
I set up another VM, configured it using the ipa-client-install script, and I can do "su <username>" on the client, but both a ssh login of a "passwd" command fails on the password.
Should I have configured my ipa server to also be a NIS server for the transition? I see that the server has a yp.conf files that appear to have been configured when I configured the ipa server and client.
You are importing your users and passwords from non-LDAP to LDAP, so there is no need to setup and use NIS anymore. IPA NIS server emulation also does not support exposing shadow map so auth via NIS will not work.
Looking at the 389-ds code, I think you should be using {crypt} prefix instead of {sha512}. SHA512 passwords stored differently to how UNIX CRYPT is done. See RHDS documentation for details, for example, https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/ht...
This is also described in https://www.freeipa.org/page/NIS_accounts_migration_preserving_Passwords ------- NOTE: Use {crypt} for any password taken from an NIS dump or /etc/shadow. It defines the password storage scheme that crypt(3) uses. -------
Remove the test user and create it again, using --setattr userpassword={crypt}<hash-from-NIS>.
Then just try
ldapwhoami -Z -H ldap://ipa.server \ -D uid=<username>,cn=users,cn=accounts,dc=example,dc=test \ -W
This should output the same DN as in -D in the case of success and should be enough to verify that authentication is working.
If it is not, then either your password hash is incorrect for 389-ds or entered password is incorrect.
I think that something else must be going on. I did a test where I added the clear-text password: [root@ipa1 ~]# ipa user-del simon -------------------- Deleted user "simon" -------------------- [root@ipa1 ~]# ipa user-add simon --first=NIS --last=USER --uid=1010 --gid=441 --gecos='Simon Matthews' --homedir=/home/simon --shell=/bin/bash --password Password: Enter Password again to verify: ------------------ Added user "simon" ------------------ User login: simon First name: NIS Last name: USER Full name: NIS USER Display name: NIS USER Initials: NU Home directory: /home/simon GECOS: Simon Matthews Login shell: /bin/bash Principal name: simon@SJ.BPS Principal alias: simon@SJ.BPS User password expiration: 20211221005503Z Email address: simon@sj.bps UID: 1010 GID: 441 Password: True Member of groups: ipausers Kerberos keys available: True
Now to test that password: [root@ipa1 ~]# ldapwhoami -Z -H ldap://ipa1.sj.bps -D 'cn=simon,cn=users,cn=accounts,dc=sj,dc=bps' -W Enter LDAP Password: ldap_bind: Invalid credentials (49)
The database has a password: [root@ipa1 ~]# ldapsearch -D "cn=Directory Manager" -x -W -b uid=simon,cn=users,cn=accounts,dc=sj,dc=bps uid userPassword Enter LDAP Password: # extended LDIF # # LDAPv3 # base <uid=simon,cn=users,cn=accounts,dc=sj,dc=bps> with scope subtree # filter: (objectclass=*) # requesting: uid userPassword #
# simon, users, accounts, sj.bps dn: uid=simon,cn=users,cn=accounts,dc=sj,dc=bps uid: simon userPassword:: e1NTSEE1MTJ9RnF3M1VpeEdmallFU1l4YVdRR2dCbFdUQnY0OExsKzNld1lJSzF UR015ci9WMkJ6TWxaQy9WSXVxUDJYVlRuMURMOVMxeEFpcVBqTFZZRWM4Z0R5cHdpcVNRZytBalZi
# search result search: 2 result: 0 Success
# numResponses: 2 # numEntries: 1
Simon Matthews via FreeIPA-users wrote:
I think that something else must be going on. I did a test where I added the clear-text password: [root@ipa1 ~]# ipa user-del simon
Deleted user "simon"
[root@ipa1 ~]# ipa user-add simon --first=NIS --last=USER --uid=1010 --gid=441 --gecos='Simon Matthews' --homedir=/home/simon --shell=/bin/bash --password Password: Enter Password again to verify:
Added user "simon"
User login: simon First name: NIS Last name: USER Full name: NIS USER Display name: NIS USER Initials: NU Home directory: /home/simon GECOS: Simon Matthews Login shell: /bin/bash Principal name: simon@SJ.BPS Principal alias: simon@SJ.BPS User password expiration: 20211221005503Z Email address: simon@sj.bps UID: 1010 GID: 441 Password: True Member of groups: ipausers Kerberos keys available: True
Now to test that password: [root@ipa1 ~]# ldapwhoami -Z -H ldap://ipa1.sj.bps -D 'cn=simon,cn=users,cn=accounts,dc=sj,dc=bps' -W Enter LDAP Password: ldap_bind: Invalid credentials (49)
The database has a password: [root@ipa1 ~]# ldapsearch -D "cn=Directory Manager" -x -W -b uid=simon,cn=users,cn=accounts,dc=sj,dc=bps uid userPassword Enter LDAP Password: # extended LDIF # # LDAPv3 # base <uid=simon,cn=users,cn=accounts,dc=sj,dc=bps> with scope subtree # filter: (objectclass=*) # requesting: uid userPassword #
# simon, users, accounts, sj.bps dn: uid=simon,cn=users,cn=accounts,dc=sj,dc=bps uid: simon userPassword:: e1NTSEE1MTJ9RnF3M1VpeEdmallFU1l4YVdRR2dCbFdUQnY0OExsKzNld1lJSzF UR015ci9WMkJ6TWxaQy9WSXVxUDJYVlRuMURMOVMxeEFpcVBqTFZZRWM4Z0R5cHdpcVNRZytBalZi
# search result search: 2 result: 0 Success
# numResponses: 2 # numEntries: 1
These same steps work for me. This is the typical way to set passwords in IPA.
rob
freeipa-users@lists.fedorahosted.org