Installation problems fro version 4.5.0 on centos 7
by Mathew Vandystadt
Hello,
I'm having problems with the installation of freeipa on a fresh centos 7 box. The installation always fails on [6/45]: starting directory server. I do see that the daemon is up and that its listening on localhost. My audit logs are ok and I get the same result with selinux in permissive mode. There seems to be a problem with the ldap daemon after the initial configuration.
Thanks
Installation logs:
017-09-25T21:38:16Z DEBUG [6/45]: starting directory server
2017-09-25T21:38:16Z DEBUG Starting external process
2017-09-25T21:38:16Z DEBUG args=/bin/systemctl start dirsrv(a)MYDOMAIN.service
2017-09-25T21:38:17Z DEBUG Process finished, return code=0
2017-09-25T21:38:17Z DEBUG stdout=
2017-09-25T21:38:17Z DEBUG stderr=
2017-09-25T21:38:17Z DEBUG Starting external process
2017-09-25T21:38:17Z DEBUG args=/bin/systemctl is-active dirsrv(a)MYDOMAIN.service
2017-09-25T21:38:17Z DEBUG Process finished, return code=0
2017-09-25T21:38:17Z DEBUG stdout=active
2017-09-25T21:38:17Z DEBUG stderr=
2017-09-25T21:38:17Z DEBUG wait_for_open_ports: localhost [389] timeout 300
2017-09-25T21:43:17Z DEBUG Traceback (most recent call last):
dirsrv access logs:
[25/Sep/2017:17:43:07.606371827 -0400] conn=291 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:07.606484146 -0400] conn=291 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:08.608386567 -0400] conn=292 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:08.608537683 -0400] conn=292 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:09.610325914 -0400] conn=293 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:09.610426954 -0400] conn=293 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:10.612250521 -0400] conn=294 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:10.612362078 -0400] conn=294 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:11.614026066 -0400] conn=295 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:11.614107541 -0400] conn=295 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:12.616101124 -0400] conn=296 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:12.616200037 -0400] conn=296 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:13.617882733 -0400] conn=297 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:13.617985060 -0400] conn=297 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:14.619732290 -0400] conn=298 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:14.619876088 -0400] conn=298 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:15.621493992 -0400] conn=299 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:15.621573126 -0400] conn=299 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:16.623358799 -0400] conn=300 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:16.623456716 -0400] conn=300 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:17.625111898 -0400] conn=301 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:17.625196358 -0400] conn=301 op=-1 fd=64 closed - B1
dirsrv error logs:
[25/Sep/2017:17:38:15.521393910 -0400] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests
[25/Sep/2017:17:38:15.589204700 -0400] - INFO - postop_modify_config_dse - The change of nsslapd-ldapilisten will not take effect until the server is restarted
[25/Sep/2017:17:38:15.679382495 -0400] - INFO - op_thread_cleanup - slapd shutting down - signaling operation threads - op stack size 1 max work q size 1 max work q stack size 1
[25/Sep/2017:17:38:15.681271086 -0400] - INFO - slapd_daemon - slapd shutting down - waiting for 14 threads to terminate
[25/Sep/2017:17:38:15.682461202 -0400] - INFO - slapd_daemon - slapd shutting down - closing down internal subsystems and plugins
[25/Sep/2017:17:38:15.688537034 -0400] - INFO - dblayer_pre_close - Waiting for 4 database threads to stop
[25/Sep/2017:17:38:16.398165344 -0400] - INFO - dblayer_pre_close - All database threads now stopped
[25/Sep/2017:17:38:16.405905222 -0400] - INFO - ldbm_back_instance_set_destructor - Set of instances destroyed
[25/Sep/2017:17:38:16.408961140 -0400] - INFO - connection_post_shutdown_cleanup - slapd shutting down - freed 1 work q stack objects - freed 1 op stack objects
[25/Sep/2017:17:38:16.521431280 -0400] - INFO - main - slapd stopped.
[25/Sep/2017:17:38:16.783464475 -0400] - INFO - main - 389-Directory/1.3.6.1 B2017.249.1616 starting up
[25/Sep/2017:17:38:16.795854380 -0400] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000
[25/Sep/2017:17:38:16.805586585 -0400] - NOTICE - ldbm_back_start - found 3882072k physical memory
[25/Sep/2017:17:38:16.807181104 -0400] - NOTICE - ldbm_back_start - found 866472k available
[25/Sep/2017:17:38:16.808666579 -0400] - NOTICE - ldbm_back_start - cache autosizing: db cache: 155282k
[25/Sep/2017:17:38:16.809929384 -0400] - NOTICE - ldbm_back_start - cache autosizing: userRoot entry cache (1 total): 262144k
[25/Sep/2017:17:38:16.814989583 -0400] - NOTICE - ldbm_back_start - total cache size: 412420406 B;
[25/Sep/2017:17:38:16.817344364 -0400] - NOTICE - dblayer_start - Resizing max db lock count: 10000 -> 50000
[25/Sep/2017:17:38:17.011113138 -0400] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests
[25/Sep/2017:17:38:17.022249715 -0400] - INFO - slapd_daemon - Listening on /var/run/MYDOMAIN.socket for LDAPI requests
6 years, 6 months
FreeIPA client installation failure
by Bhavin Vaidya
Hello,
Thank you all for help in past, as I'm keep encountering one after another issue.
Sorry for long email, as posting log. let me know if there is other way.
IPA Server OS: CentOS Linux release 7.0.1406 (Core)
IPA Server RPM: ipa-server-4.4.0-14.el7.centos.7.x86_64
Client OS: CentOS Linux release 7.3.1611 (Core)
IPA client RPM: ipa-client-4.5.0-21.el7.centos.1.2.x86_64 (as well as ipa-client-4.4.0-14.el7.centos.7.x86_64)
I'm not able to enroll new client recently, and getting following message:
Enrolled in IPA realm EXAMPLE.COM
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm EXAMPLE.COM
trying https://ds01.example.com/ipa/json
[try 1]: Forwarding 'schema' to json server 'https://ds01.example.com/ipa/json'
trying https://ds01.example.com/ipa/session/json
[try 1]: Forwarding 'ping' to json server 'https://ds01.example.com/ipa/session/json'
[try 1]: Forwarding 'ca_is_enabled' to json server 'https://ds01.example.com/ipa/session/json'
Installation failed. Force set so not rolling back changes.
Failed to add EXAMPLE.COM IPA CA to the IPA NSS database.
The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information
The ipa-client-install.log is:
2017-10-05T23:34:37Z DEBUG Logging to /var/log/ipaclient-install.log
2017-10-05T23:34:37Z DEBUG ipa-client-install was invoked with arguments [] and options: {'no_dns_sshfp': False, 'force': True, 'verbose': False, 'ip_addresses': None, 'configure_firefox': False, 'realm_name': None, 'force_ntpd': False, 'on_master': False, 'no_nisdomain': False, 'ssh_trust_dns': False, 'principal': None, 'keytab': None, 'no_ntp': False, 'domain_name': None, 'request_cert': False, 'fixed_primary': False, 'no_ac': False, 'no_sudo': False, 'ca_cert_files': None, 'all_ip_addresses': False, 'kinit_attempts': None, 'ntp_servers': None, 'enable_dns_updates': False, 'no_sshd': False, 'no_sssd': False, 'no_krb5_offline_passwords': False, 'servers': None, 'no_ssh': False, 'force_join': False, 'firefox_dir': None, 'unattended': False, 'quiet': False, 'nisdomain': None, 'prompt_password': False, 'host_name': None, 'permit': False, 'automount_location': None, 'preserve_sssd': False, 'mkhomedir': False, 'log_file': None, 'uninstall': False}
2017-10-05T23:34:37Z DEBUG IPA version 4.5.0-21.el7.centos.1.2
2017-10-05T23:34:37Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
2017-10-05T23:34:37Z DEBUG Starting external process
2017-10-05T23:34:37Z DEBUG args=/usr/sbin/selinuxenabled
2017-10-05T23:34:37Z DEBUG Process finished, return code=1
2017-10-05T23:34:37Z DEBUG stdout=
2017-10-05T23:34:37Z DEBUG stderr=
2017-10-05T23:34:37Z DEBUG Starting external process
2017-10-05T23:34:37Z DEBUG args=/bin/systemctl is-enabled chronyd.service
2017-10-05T23:34:37Z DEBUG Process finished, return code=0
2017-10-05T23:34:37Z DEBUG stdout=enabled
2017-10-05T23:34:37Z DEBUG stderr=
2017-10-05T23:34:37Z DEBUG [IPA Discovery]
2017-10-05T23:34:37Z DEBUG Starting IPA discovery with domain=None, servers=None, hostname=groc-5.example.com
2017-10-05T23:34:37Z DEBUG Start searching for LDAP SRV record in "example.com" (domain of the hostname) and its sub-domains
2017-10-05T23:34:37Z DEBUG Search DNS for SRV record of _ldap._tcp.example.com
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ipa01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds02.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds03.example.com.
2017-10-05T23:34:37Z DEBUG [Kerberos realm search]
2017-10-05T23:34:37Z DEBUG Search DNS for TXT record of _kerberos.example.com
2017-10-05T23:34:37Z DEBUG DNS record found: "EXAMPLE.COM"
2017-10-05T23:34:37Z DEBUG Search DNS for SRV record of _kerberos._udp.example.com
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 88 ipa01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 88 ds01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 88 ds03.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 88 ds02.example.com.
2017-10-05T23:34:37Z DEBUG [LDAP server check]
2017-10-05T23:34:37Z DEBUG Verifying that ds01.example.com (realm EXAMPLE.COM) is an IPA server
2017-10-05T23:34:37Z DEBUG Init LDAP connection to: ldap://ds01.example.com:389
2017-10-05T23:34:37Z DEBUG Search LDAP server for IPA base DN
2017-10-05T23:34:37Z DEBUG Check if naming context 'dc=example,dc=com' is for IPA
2017-10-05T23:34:37Z DEBUG Naming context 'dc=example,dc=com' is a valid IPA context
2017-10-05T23:34:37Z DEBUG Search for (objectClass=krbRealmContainer) in dc=example,dc=com (sub)
2017-10-05T23:34:37Z DEBUG Found: cn=EXAMPLE.COM,cn=kerberos,dc=example,dc=com
2017-10-05T23:34:37Z DEBUG Discovery result: Success; server=ds01.example.com, domain=example.com, kdc=ipa01.example.com,ds01.example.com,ds03.example.com,ds02.example.com, basedn=dc=example,dc=com
2017-10-05T23:34:37Z DEBUG Validated servers: ds01.example.com
2017-10-05T23:34:37Z DEBUG will use discovered domain: example.com
2017-10-05T23:34:37Z DEBUG Start searching for LDAP SRV record in "example.com" (Validating DNS Discovery) and its sub-domains
2017-10-05T23:34:37Z DEBUG Search DNS for SRV record of _ldap._tcp.example.com
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ipa01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds02.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds03.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds01.example.com.
2017-10-05T23:34:37Z DEBUG DNS validated, enabling discovery
2017-10-05T23:34:37Z DEBUG will use discovered server: ds01.example.com
2017-10-05T23:34:37Z INFO Discovery was successful!
2017-10-05T23:34:37Z DEBUG will use discovered realm: EXAMPLE.COM
2017-10-05T23:34:37Z DEBUG will use discovered basedn: dc=example,dc=com
2017-10-05T23:34:37Z INFO Client hostname: groc-5.example.com
2017-10-05T23:34:37Z DEBUG Hostname source: Machine's FQDN
2017-10-05T23:34:37Z INFO Realm: EXAMPLE.COM
2017-10-05T23:34:37Z DEBUG Realm source: Discovered from LDAP DNS records in ds01.example.com
2017-10-05T23:34:37Z INFO DNS Domain: example.com
2017-10-05T23:34:37Z DEBUG DNS Domain source: Discovered LDAP SRV records from example.com (domain of the hostname)
2017-10-05T23:34:37Z INFO IPA Server: ds01.example.com
2017-10-05T23:34:37Z DEBUG IPA Server source: Discovered from LDAP DNS records in ds01.example.com
2017-10-05T23:34:37Z INFO BaseDN: dc=example,dc=com
2017-10-05T23:34:37Z DEBUG BaseDN source: From IPA server ldap://ds01.example.com:389
2017-10-05T23:34:39Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
2017-10-05T23:34:39Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
2017-10-05T23:34:39Z DEBUG Starting external process
2017-10-05T23:34:39Z DEBUG args=/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r EXAMPLE.COM
2017-10-05T23:34:39Z DEBUG Process finished, return code=5
2017-10-05T23:34:39Z DEBUG stdout=
2017-10-05T23:34:39Z DEBUG stderr=realm not found
2017-10-05T23:34:39Z INFO Skipping synchronizing time with NTP server.
2017-10-05T23:34:41Z DEBUG will use principal provided as option: admin
2017-10-05T23:34:41Z DEBUG Starting external process
2017-10-05T23:34:41Z DEBUG args=keyctl get_persistent @s 0
2017-10-05T23:34:41Z DEBUG Process finished, return code=0
2017-10-05T23:34:41Z DEBUG stdout=218715285
2017-10-05T23:34:41Z DEBUG stderr=
2017-10-05T23:34:41Z DEBUG Enabling persistent keyring CCACHE
2017-10-05T23:34:41Z DEBUG Writing Kerberos configuration to /tmp/tmpVCsDCR:
2017-10-05T23:34:41Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
EXAMPLE.COM = {
kdc = ds01.example.com:88
master_kdc = ds01.example.com:88
admin_server = ds01.example.com:749
kpasswd_server = ds01.example.com:464
default_domain = example.com
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
groc-5.example.com = EXAMPLE.COM
2017-10-05T23:34:45Z DEBUG Initializing principal admin(a)EXAMPLE.COM<mailto:admin@EXAMPLE.COM> using password
2017-10-05T23:34:45Z DEBUG Starting external process
2017-10-05T23:34:45Z DEBUG args=/usr/bin/kinit admin(a)EXAMPLE.COM<mailto:admin@EXAMPLE.COM> -c /tmp/krbccbP9vNK/ccache
2017-10-05T23:34:45Z DEBUG Process finished, return code=0
2017-10-05T23:34:45Z DEBUG stdout=Password for admin(a)EXAMPLE.COM<mailto:admin@EXAMPLE.COM>:
2017-10-05T23:34:45Z DEBUG stderr=
2017-10-05T23:34:45Z DEBUG trying to retrieve CA cert via LDAP from ds01.example.com
2017-10-05T23:34:45Z DEBUG retrieving schema for SchemaCache url=ldap://ds01.example.com:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x2c25ea8>
2017-10-05T23:34:45Z INFO Successfully retrieved CA cert
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2014-08-03 19:28:18
Valid Until: 2034-08-03 19:28:18
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2017-05-30 00:17:28
Valid Until: 2037-05-30 00:17:28
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2017-05-30 00:19:13
Valid Until: 2037-05-30 00:19:13
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2017-05-30 00:38:33
Valid Until: 2037-05-30 00:38:33
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2017-06-01 12:55:08
Valid Until: 2037-06-01 12:55:08
2017-10-05T23:34:45Z DEBUG Starting external process
2017-10-05T23:34:45Z DEBUG args=/usr/sbin/ipa-join -s ds01.example.com -b dc=example,dc=com -h groc-5.example.com
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=Failed to parse result: Failed to decode GetKeytab Control.
Retrying with pre-4.0 keytab retrieval method...
Failed to retrieve encryption type Camellia-128 CTS mode with CMAC (#25)
Failed to retrieve encryption type Camellia-256 CTS mode with CMAC (#26)
Keytab successfully retrieved and stored in: /etc/krb5.keytab
Certificate subject base is: O=EXAMPLE.COM
2017-10-05T23:34:47Z INFO Enrolled in IPA realm EXAMPLE.COM
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=kdestroy
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Initializing principal host/groc-5.example.com(a)EXAMPLE.COM<mailto:host/groc-5.example.com@EXAMPLE.COM> using keytab /etc/krb5.keytab
2017-10-05T23:34:47Z DEBUG using ccache /etc/ipa/.dns_ccache
2017-10-05T23:34:47Z DEBUG Attempt 1/5: success
2017-10-05T23:34:47Z DEBUG Backing up system configuration file '/etc/ipa/default.conf'
2017-10-05T23:34:47Z DEBUG -> Not backing up - '/etc/ipa/default.conf' doesn't exist
2017-10-05T23:34:47Z INFO Created /etc/ipa/default.conf
2017-10-05T23:34:47Z DEBUG Backing up system configuration file '/etc/sssd/sssd.conf'
2017-10-05T23:34:47Z DEBUG -> Not backing up - '/etc/sssd/sssd.conf' doesn't exist
2017-10-05T23:34:47Z INFO New SSSD config will be created
2017-10-05T23:34:47Z DEBUG Backing up system configuration file '/etc/nsswitch.conf'
2017-10-05T23:34:47Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index'
2017-10-05T23:34:47Z INFO Configured sudoers in /etc/nsswitch.conf
2017-10-05T23:34:47Z INFO Configured /etc/sssd/sssd.conf
2017-10-05T23:34:47Z DEBUG Backing up system configuration file '/etc/krb5.conf'
2017-10-05T23:34:47Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index'
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=keyctl get_persistent @s 0
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=218715285
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Enabling persistent keyring CCACHE
2017-10-05T23:34:47Z DEBUG Writing Kerberos configuration to /etc/krb5.conf:
2017-10-05T23:34:47Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
EXAMPLE.COM = {
kdc = ds01.example.com:88
master_kdc = ds01.example.com:88
admin_server = ds01.example.com:749
kpasswd_server = ds01.example.com:464
default_domain = example.com
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
groc-5.example.com = EXAMPLE.COM
2017-10-05T23:34:47Z INFO Configured /etc/krb5.conf for IPA realm EXAMPLE.COM
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -N -f /tmp/tmpzYMe1L/pwdfile.txt -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A -n CA certificate 1 -t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A -n CA certificate 2 -t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A -n CA certificate 3 -t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A -n CA certificate 4 -t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A -n CA certificate 5 -t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Error retrieving cookie from the persistent storage: expected string or buffer
2017-10-05T23:34:47Z DEBUG failed to find session_cookie in persistent storage for principal 'host/groc-5.example.com(a)EXAMPLE.COM'
2017-10-05T23:34:47Z INFO trying https://ds01.example.com/ipa/json
2017-10-05T23:34:47Z DEBUG New HTTP connection (ds01.example.com)
2017-10-05T23:34:47Z DEBUG received Set-Cookie (<type 'list'>)'['ipa_session=c8b0ad6e060540145a210905bd242379; Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:47 GMT; Secure; HttpOnly']'
2017-10-05T23:34:47Z DEBUG storing cookie 'ipa_session=c8b0ad6e060540145a210905bd242379;' for principal host/groc-5.example.com(a)EXAMPLE.COM<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:47Z DEBUG Created connection context.rpcclient_53194256
2017-10-05T23:34:47Z INFO [try 1]: Forwarding 'schema' to json server 'https://ds01.example.com/ipa/json'
2017-10-05T23:34:47Z DEBUG HTTP connection keep-alive (ds01.example.com)
2017-10-05T23:34:47Z DEBUG received Set-Cookie (<type 'list'>)'['ipa_session=0552135805674c077504cbd3fcecfb87; Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:47 GMT; Secure; HttpOnly']'
2017-10-05T23:34:47Z DEBUG storing cookie 'ipa_session=0552135805674c077504cbd3fcecfb87;' for principal host/groc-5.example.com(a)EXAMPLE.COM<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:48Z DEBUG Destroyed connection context.rpcclient_53194256
2017-10-05T23:34:48Z DEBUG importing all plugin modules in ipaclient.remote_plugins.schema$ed0ad850...
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.remote_plugins.schema$ed0ad850.plugins
2017-10-05T23:34:48Z DEBUG importing all plugin modules in ipaclient.plugins...
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.automember
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.automount
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.ca
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.cert
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.certmap
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.certprofile
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.dns
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.hbacrule
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.hbactest
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.host
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.idrange
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.internal
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.location
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.migration
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.misc
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.otptoken
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.otptoken_yubikey
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.passwd
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.permission
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.rpcclient
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.server
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.service
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.sudorule
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.topology
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.trust
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.user
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.vault
2017-10-05T23:34:48Z DEBUG found session_cookie in persistent storage for principal 'host/groc-5.example.com(a)EXAMPLE.COM', cookie: 'ipa_session=0552135805674c077504cbd3fcecfb87'
2017-10-05T23:34:48Z DEBUG setting session_cookie into context 'ipa_session=0552135805674c077504cbd3fcecfb87;'
2017-10-05T23:34:48Z INFO trying https://ds01.example.com/ipa/session/json
2017-10-05T23:34:48Z DEBUG New HTTP connection (ds01.example.com)
2017-10-05T23:34:48Z DEBUG received Set-Cookie (<type 'list'>)'['ipa_session=0552135805674c077504cbd3fcecfb87; Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:48 GMT; Secure; HttpOnly']'
2017-10-05T23:34:48Z DEBUG storing cookie 'ipa_session=0552135805674c077504cbd3fcecfb87;' for principal host/groc-5.example.com(a)EXAMPLE.COM<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:48Z DEBUG Created connection context.rpcclient_94332368
2017-10-05T23:34:48Z DEBUG Try RPC connection
2017-10-05T23:34:48Z INFO [try 1]: Forwarding 'ping' to json server 'https://ds01.example.com/ipa/session/json'
2017-10-05T23:34:48Z DEBUG HTTP connection keep-alive (ds01.example.com)
2017-10-05T23:34:48Z DEBUG received Set-Cookie (<type 'list'>)'['ipa_session=0552135805674c077504cbd3fcecfb87; Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:48 GMT; Secure; HttpOnly']'
2017-10-05T23:34:48Z DEBUG storing cookie 'ipa_session=0552135805674c077504cbd3fcecfb87;' for principal host/groc-5.example.com(a)EXAMPLE.COM<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:48Z INFO [try 1]: Forwarding 'ca_is_enabled' to json server 'https://ds01.example.com/ipa/session/json'
2017-10-05T23:34:48Z DEBUG HTTP connection keep-alive (ds01.example.com)
2017-10-05T23:34:48Z DEBUG received Set-Cookie (<type 'list'>)'['ipa_session=0552135805674c077504cbd3fcecfb87; Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:48 GMT; Secure; HttpOnly']'
2017-10-05T23:34:48Z DEBUG storing cookie 'ipa_session=0552135805674c077504cbd3fcecfb87;' for principal host/groc-5.example.com(a)EXAMPLE.COM<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:48Z DEBUG Starting external process
2017-10-05T23:34:48Z DEBUG args=/usr/bin/certutil -d /etc/ipa/nssdb -N -f /etc/ipa/nssdb/pwdfile.txt -f /etc/ipa/nssdb/pwdfile.txt
2017-10-05T23:34:48Z DEBUG Process finished, return code=0
2017-10-05T23:34:48Z DEBUG stdout=
2017-10-05T23:34:48Z DEBUG stderr=
2017-10-05T23:34:49Z DEBUG Adding CA certificates to the IPA NSS database.
2017-10-05T23:34:49Z DEBUG Starting external process
2017-10-05T23:34:49Z DEBUG args=/usr/bin/certutil -d /etc/ipa/nssdb -A -n EXAMPLE.COM IPA CA -t CT,C,C -f /etc/ipa/nssdb/pwdfile.txt
2017-10-05T23:34:49Z DEBUG Process finished, return code=0
2017-10-05T23:34:49Z DEBUG stdout=
2017-10-05T23:34:49Z DEBUG stderr=
2017-10-05T23:34:49Z DEBUG Starting external process
2017-10-05T23:34:49Z DEBUG args=/usr/bin/certutil -d /etc/ipa/nssdb -A -n EXAMPLE.COM IPA CA -t CT,C,C -f /etc/ipa/nssdb/pwdfile.txt
2017-10-05T23:34:49Z DEBUG Process finished, return code=255
2017-10-05T23:34:49Z DEBUG stdout=
2017-10-05T23:34:49Z DEBUG stderr=certutil: could not add certificate to token or database: SEC_ERROR_ADDING_CERT: Error adding certificate to database.
2017-10-05T23:34:49Z WARNING Installation failed. Force set so not rolling back changes.
2017-10-05T23:34:49Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 333, in run
cfgr.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 368, in run
self.execute()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 392, in execute
for _nothing in self._executor():
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure
next(executor)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install
for _nothing in self._installer(self.parent):
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3621, in main
install(self)
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2348, in install
_install(options)
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2791, in _install
rval=CLIENT_INSTALL_ERROR)
2017-10-05T23:34:49Z DEBUG The ipa-client-install command failed, exception: ScriptError: Failed to add EXAMPLE.COM IPA CA to the IPA NSS database.
2017-10-05T23:34:49Z ERROR Failed to add EXAMPLE.COM IPA CA to the IPA NSS database.
2017-10-05T23:34:49Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information
Regards,
Bhavin
6 years, 6 months
problems installing replicas
by Charles Hedrick
I’ve mentioned problems setting up a replica. I just got it to work.
The install ran cleanly. No sign of errors. However a couple of items ended up in LDAP on the replica, but didn’t get into the copies on the original 2 systems. krb4.cs.rutgers.edu<http://krb4.cs.rutgers.edu> is the new replica.
cn=krb4.cs.rutgers.edu<http://krb4.cs.rutgers.edu>,cn=masters,cn=ipa,cn=etc,dc=cs,dc=rutgers,dc=edu
was missing all the IPA object classes, and ipaReplTopoManagedSuffix, ipaMinDomainLevel, and ipaMaxDomainLevel.
cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=cs,dc=rutgers,dc=edu
was missing memberPrincipal: HTTP/krb4.cs.rutgers.edu(a)CS.RUTGERS.EDU<mailto:HTTP/krb4.cs.rutgers.edu@CS.RUTGERS.EDU>
ipa topologysegment-show believed that the replication agreement between the new system and the one it was installed from was one-way (left-to-right), although it appears both replication agreements were in place and worked.
I added the missing attributes, deleted the broken topology segment, deleted the replication agreement that wasn’t reflected in the topology, and then put back the topology segment.
The system now appears to be working without error.
6 years, 6 months
IPA policy creation
by Mark Haney
Due to people not documenting squat here over years, one of our servers
configurations got jacked up when I migrated it from OpenLDAP to IPA.
This is a CentOS 6 server that runs RANCID to pull customer edge router
configs. The old OpenLDAP setup had a policy in Kerberos that would
create a symlink to the RANCID backup directory in the home directory of
a new user account upon first login. Is it possible to set this up in
IPA? If so, are there docs/how tos on doing this?
I would assume it's an IPA policy, but I'm not sure how similar it would
be to doing it in OpenLDAP/Kerberos.
--
Mark Haney
Network Engineer at NeoNova
919-460-3330 option 1
mark.haney(a)neonova.net
www.neonova.net
6 years, 6 months
Samba utilizing FreeIPA as Auth
by Patrick No
Hello all,
First post here. I have been researching for quite some time and as a Linux user I would list myself as a medium level. Not an expert, but not new. I have a FreeIPA Server that is setup as the central identity management server. I want to setup two shares within samba using FreeIPA as the auth source. Please any and all help is welcomed. I am doing this for learning purposes so an pointers are helpful as well.
Share1: public
Share2: homes
Here are a few sites\articles I have read and tried to glean off of:
https://www.freeipa.org/page/Howto/I...erver_With_IPA
https://bgstack15.wordpress.com/2017...-freeipa-auth/
https://centos.org/forums/viewtopic.php?f=50&t=61110
https://www.centos.org/docs/5/html/D...a-servers.html
I "think" that the problem i'm facing is either a permissions\security(firewalld\selinux) or configuration issue. I am not the best with SELinux yet, but I do want to use it so turning it off permanently is not an option.
When trying from a windows 7 VM I get the message "You do not have permission to access \\samba.domain.com" checking from another Linux client that's already on the FreeIPA domain and running as the admin user I get this message:
[root@Desktop ~]# kinit admin
Password for admin(a)DOMAIN.COM:
[root@Desktop ~]# smbclient -k -L samba.domain.com
session setup failed: NT_STATUS_ACCESS_DENIED
[root@Desktop ~]# smbclient -k //samba.domain.com/public
session setup failed: NT_STATUS_ACCESS_DENIED
Below are the steps I have taken to attempt my setup...
[root@samba ~]# yum install ipa-client sssd-libwclient samba samba-client
[root@samba ~]# ipa-client-install --mkhomedir --force-ntpd
Discovery was successful!
Client hostname: samba.domain.com
Realm: DOMAIN.COM
DNS Domain: domain.com
IPA Server: ldap.domain.com
BaseDN: dc=domain,dc=com
Continue to configure the system with these values? [no]: yes
Synchronizing time with KDC...
Attempting to sync time using ntpd. Will timeout after 15 seconds
User authorized to enroll computers: admin
Password for admin(a)DOMAIN.COM:
Successfully retrieved CA cert
Subject: CN=Certificate Authority,O=DOMAIN.COM
Issuer: CN=Certificate Authority,O=DOMAIN.COM
Valid From: 2017-09-22 16:17:45
Valid Until: 2037-09-22 16:17:45
....
....
......
[root@samba ~]# kinit admin
Password for admin(a)PWG-WORLD.COM:
[root@samba ~]# authconfig --enablesssdauth --enablemkhomedir --update
[root@samba ~]# man ipa-getkeytab
[root@samba ~]# ipa-getkeytab -s ldap.pwg-world.com -p cifs/samba.pwg-world.com -k /etc/samba/samba.keytab
Keytab successfully retrieved and stored in: /etc/samba/samba.keytab
[root@samba ~]# cp /etc/samba/smb.conf /etc/samba/smb.conf.bkp
[root@samba ~]# vi /etc/samba/smb.conf
~~~~~~~~~~~~~~~~~~~~~~/etc/samba/smb.conf~~~~~~~~~~~~~~~~~~~~~~
[global]
workgroup = DOMAIN
realm = DOMAIN.COM
dedicated keytab file = FILE:/etc/samba/samba.keytab
kerberos method = dedicated keytab
log file = /var/log/samba/log.%m
security = ads
[homes]
browsable = no
writable = yes
[shared]
path = /home/shared
writable = yes
browsable = yes
write list = @admins
[public]
path = /public
writable = yes
browsable = yes
valid users = @ipausers
~~~~~~~~~~~~~~~~~~~~~~/etc/samba/smb.conf~~~~~~~~~~~~~~~~~~~~~~
[root@samba ~]# setsebool -P samba_enable_home_dirs on
[root@samba ~]# semanage fcontext -a -t samba_share_t "/public(/.*)?"
[root@samba ~]# restorecon -Rv /public
restorecon reset /public context system_u:object_r:public_content_rw_t:s0->system_u:object_r:samba_share_t:s0
[root@samba ~]# firewall-cmd --permanent --add-service=samba
success
[root@samba ~]# firewall-cmd --reload
success
For the ldap portion:
[root@ldap ~]# kinit admin
Password for admin(a)domain.COM:
[root@ldap ~]# ipa service-add cifs/samba.domain.com
------------------------------------------------------
Added service "cifs/samba.domain.com(a)DOMAIN.COM"
------------------------------------------------------
Principal name: cifs/samba.domain.com(a)DOMAIN.COM
Principal alias: cifs/samba.domain.com(a)DOMAIN.COM
Managed by: samba.domain.com
FreeIPA Server Version:
[root@ldap ~]# rpm -qa | grep ipa-server
ipa-server-trust-ad-4.5.0-21.el7.centos.1.2.x86_64
ipa-server-4.5.0-21.el7.centos.1.2.x86_64
ipa-server-common-4.5.0-21.el7.centos.1.2.noarch
ipa-server-dns-4.5.0-21.el7.centos.1.2.noarch
FreeIPA Client Version:
[root@samba ~]# rpm -qa | grep ipa-client
ipa-client-common-4.5.0-21.el7.centos.1.2.noarch
ipa-client-4.5.0-21.el7.centos.1.2.x86_64
6 years, 6 months
Re: updating certificates
by Rob Crittenden
Josh wrote:
> Greetings to all,
>
> A follow up on
> https://www.redhat.com/archives/freeipa-users/2017-January/msg00051.html
>
> I missed expiration date and now ipa-certupdate command fails with SSL:
> CERTIFICATE_VERIFY_FAILED.
>
> Should I update httpd certificate manually or there is a workaround to
> allow ipa-certupdate to proceed?
You could try going back in time when the certs are still valid to try
the certupdate.
Or manually updating the certs could work too.
rob
6 years, 6 months
VPN access with FreeRADIUS enforcing OTP backed by FreeIPA
by Andy Stubbs
I'm having a bit of a hard time trying to enforce OTP on VPN access using
FreeRADIUS backed by FreeIPA as the auth oracle.
I'm using a FreeIPA 4.5.0-21 client which is running FreeRADIUS 3.0.13-8,
enrolled to a FreeIPA 4.5.0-21 server, both on clean installs of CentOS
7.4.1708
I need to enforce OTP for VPN access, and have it optional everywhere else.
This kind of access based on auth indicators seems to be pretty standard,
and is even mentioned in the RH IdM manual (section 22.3).
But I can't get it to work. I have been banging my head against this for a
few days now. Could somebody point me in the right direction please?
I have users who have "password" and "otp" auth mechanisms enabled. Of
course, this means I can't use LDAP to enforce OTP.
PAM feels like it should be the right answer, but I've singularly failed to
coax it into doing the right thing.
I note that if "password" is _not_ an allowed auth mechanism, then
system-auth, su, and sudo seem to be happy accepting "password+OTP" at the
"First Factor" and leaving "Second Factor" blank. OTOH, if "password" is
allowed, the "password+OTP" at "First Factor" and leaving "Second Factor
(optional)" blank fails.
I've tried enforcing OTP on the host the FreeRADIUS server is running on,
instead of on the user, and trying "password+OTP" at the "password" prompt.
Also no dice.
In any case, it seems that whatever pam module I configure the rlm_pam
module to use, "password+OTP" just isn't accepted, but if I turn off otp as
an auth mechanism for a user, the password is accepted just fine.
I've tried krb5 too, creating a specific service, and trying just about
every combination of password/otp options on host, service, and user... and
again, no dice (though it works if otp is off on all of them, but that's
obviously not what I need to achieve).
I can't find any reference to a specific API for testing an OTP token for a
user independent of a password (though I have seen references to the
ipa-otpd process on the V4/OTP page), and I don't really want to roll my
own - so that kind of rules out writing my own python/perl module for
FreeRADIUS. Nor do I particularly relish the idea of managing another layer
of dedicated OTP software like privacyIDEA. (Of course, if that's the
_right_ answer, then that's what I'll do)
I figure I must be missing something fairly simple as I just can't get it
to work and I can't imagine this is a particularly exotic use case: force
OTP on VPN and have it optional everywhere else.
Any pointers? I would love this to be an embarrassing and trivial oversight
on my part. Please let it be that :)
Thanks in advance for your consideration,
Andy
--
<https://www.treatwell.com/>
Andrew Stubbs, PhD
Head of Technical Operations
+44 203 770 4582
treatwell.co.uk
6 years, 6 months
FreeIPA Sudo Issue
by Alka Murali
Hello Team,
I have integrated my Ubuntu/Debian and CentOS Servers as IPA Clients to my
FreeIPA Server. The custom sudo rule added by me also works for the users
assigned to the rule.
The first login attempt as well as sudo access works fine. However if the
user logins later or after few days, the sudo user is not recognised and
inturn the user is getting locked out of the server. I have tested this and
can see that even though there is no failed attempt by the user on the
server, pam_sss is giving access_denied error message which intunrs blocks
the user for ever.
Is there any sort of pam settings that needs to be applied?
--
Regards,
Alka Murali
6 years, 6 months
planning for migration
by Andrew Meyer
Hello,I am planning to migrate from a OpenLDAP installation to FreeIPA.
I have been following the directions and matching it to several blog posts about this however I am coming up with errors.
[user@infra-test-ipa ~]$ ipa migrate-ds --user-container=users --group-container=group --user-objectclass=inetOrgPerson --group-objectclass=groupOfNames,groupOfUniqueNames ldap://my.host.name:389Password:ipa: ERROR: invalid 'group_container': malformed RDN string = "group"[user@infra-test-ipa ~]$ ipa migrate-ds --user-container=users --group-container=group ldap://my.host.name:389Password:ipa: ERROR: invalid 'group_container': malformed RDN string = "group"[user@infra-test-ipa ~]$ ipa migrate-ds --user-container=users --group-container=Group ldap://my.host.name:389Password:ipa: ERROR: invalid 'group_container': malformed RDN string = "Group"[user@infra-test-ipa ~]$ sudo kinit adminPassword for admin@mynewdomain.net:[user@infra-test-ipa ~]$ sudo ipa migrate-ds --user-container=users --group-container=Group ldap://my.host.name:389Password:ipa: ERROR: invalid 'group_container': malformed RDN string = "Group"[user@infra-test-ipa ~]$ sudo ipa migrate-ds --user-container="Users" --group-container=Group ldap://my.host.name:389Password:ipa: ERROR: invalid 'group_container': malformed RDN string = "Group"[user@infra-test-ipa ~]$ sudo ipa migrate-ds --user-container="Users" --base-dn="ou=Users,dc=olddomain,dc=local" --with-compat --group-container="Group" ldap://my.host.name:389Password:ipa: ERROR: invalid 'group_container': malformed RDN string = "Group"
Has anyone run into this? I am running CentOS 7 w/ the latest version of everything.
6 years, 6 months