November 2017 - FreeIPA-users - Fedora mailing-lists

Re: passwd change timeout
by Rob Crittenden 07 Nov '17

07 Nov '17

Moving back to freeipa-users list. Stephen Berg (Contractor, Code 7320) wrote: > On 11/06/2017 09:37 AM, Rob Crittenden wrote: >> Stephen Berg (Contractor, Code 7320) via FreeIPA-users wrote: >>> On 11/06/2017 08:02 AM, Stephen Berg (Contractor, Code 7320) via >>> FreeIPA-users wrote: >>>> Had a few users get kicked off a console session while changing their >>>> password. Seems there's a rather short timeout for this. Is the >>>> timeout a configuration that can be adjusted somewhere in IPA or >>>> possibly pam.d? I've been looking for it but haven't come across >>>> anything that looks likely so far. >>>> >>> Forgot to mention... Systems are running SciLinux 7.3 or 7.4 same as the >>> ipa servers. >>> >> Need more information. >> >> How are you changing the password? I'm assuming you mean logging into >> the console with an expired password but it isn't clear. >> >> What output are you getting? >> >> Was this configuring using ipa-client-install? >> >> >> >> rob >> > Switching to a console with Ctrl-Alt-F3, user with an expired password > logs in, gets told their password has expired and they need to change > it. The system asks for current password again, they type that, then > they type a new password twice to get it changed. The problem comes up > with a slow typist and partway through the process the console just > kicks them off and they're back at a login prompt. There's no error > message on the screen that I've been able to see, and I'm not seeing any > log entries to indicate a problem. > IIRC agetty handles console logins these days and I'm assuming that is invoked by systemd-getty-generator. I'm not sure what knobs are available to tune timeouts with these. rob

2 2

passwd change timeout
by Stephen Berg (Contractor, Code 7320) 07 Nov '17

07 Nov '17

Had a few users get kicked off a console session while changing their password. Seems there's a rather short timeout for this. Is the timeout a configuration that can be adjusted somewhere in IPA or possibly pam.d? I've been looking for it but haven't come across anything that looks likely so far. -- -- *Stephen Berg* Systems Administrator NRL Code: 7320 Office: 228-688-5738 stephen.berg.ctr(a)nrlssc.navy.mil NRL Logo

2 2

AD one-way trust on multidatacenter environment
by SOLER SANGUESA Miguel 07 Nov '17

07 Nov '17

hello, I want to do a one-way AD trust on a multidatacenter environment. This is the topology (2 AD servers and 2 IPA servers on each location replicated each other): DATACENTER1: AD1dc1.ad.example.com AD2dc1.ad.example.com IPA1dc1.ipa.example.com IPA2dc1.ipa.example.com DATACENTER2: AD1dc2.ad.example.com AD2dc2.ad.example.com IPA1dc2.ipa.example.com IPA2dc2.ipa.example.com The problem I see is that I execute "ipa trust-add" it will connect to any of the 4 AD servers as it searchs for the SRV records, and I want (I think is the best option) IPA servers to connect just the AD servers on their datacenter: _SERVICE._PROTOCOL[.dc._msdcs] and I want to use SRV records with sites like: # dig +short -t SRV _kerberos._udp.dc1-Site._sites.ad.example.com. 0 100 88 AD1dc1.ad.example.com. 0 100 88 AD2dc1.ad.example.com. # dig +short -t SRV _kerberos._udp.dc2-Site._sites.ad.example.com. 0 100 88 AD1dc2.ad.example.com. 0 100 88 AD2dc2.ad.example.com. I was wondering creating the trust using the DNS of the site (only resolves IPs of the AD servers on this datacenter), for example from IPA1dc1.ipa.example.com: ipa trust-add --type=ad ad.example.com --server=dc1.ad.example.com --trust-secret But the problem here is: How I configure IPA servers on Datacenter2 to connect to AD servers on datacenter2 (DNS: dc2.ad.example.com)? Thanks. /Miguel Soler

2 1

adding new server to freeipa
by Andrew Meyer 06 Nov '17

06 Nov '17

If I have a server that is in a subdomain of my tld for FreeIPA and I want it to get added into that specific zone during the client install process, the installer errors out and says that it will only recognize 1 FreeIPA server and failover to the other will not be possible. Is there some way around this? Something I can change in the /etc/sssd/sssd.conf ? Domain is example.com my new server is server123.mgt.datacenter.example.com I have the zones created but I don't see the kerberos records in there. Thank you!

3 3

FreeIPA OTP/FAST: MIT KDC <--> heimdal client integration
by Oleksandr Yermolenko 03 Nov '17

03 Nov '17

Hi, I have a strange (for me?) situation using MIT KDC together with Heimdal client. PKINIT/FAST scenario. STEP 1: client side: kinit --anonymous klist -v Credentials cache: FILE:/tmp/krb5cc_1000 Principal: WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS Cache version: 4 Server: krbtgt/IDM.CRP(a)IDM.CRP Client: WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS Ticket etype: aes256-cts-hmac-sha1-96, kvno 1 Ticket length: 273 Auth time: Nov 2 10:30:45 2017 End time: Nov 3 10:30:45 2017 Ticket flags: anonymous, enc-pa-rep, pre-authent, initial, forwardable Addresses: addressless MIT KDC side log krb5kdc.log: Nov 02 09:43:41 ipa31.idm.crp krb5kdc[1932](info): AS_REQ (6 etypes {18 17 20 19 16 23}) 2001:67c:2X70:20X0:d5de:47fa:4de1:b0e7: ISSUE: authtime 1509612221, etypes {rep=18 tkt=18 ses=18}, WELLKNOWN/ANONYMOUS(a)IDM.CRP for krbtgt/IDM.CRP(a)IDM.CRP I guess everything is fine. STEP 2: client kinit --cache=FILE:/tmp/krb5cc_1000 aae(a)IDM.CRP aae(a)IDM.CRP's Password: passwordOTP kinit: Password incorrect KDC log: Nov 02 09:45:56 ipa31.idm.crp krb5kdc[1932](info): preauth (encrypted_timestamp) verify failure: Preauthentication failed Nov 02 09:45:56 ipa31.idm.crp krb5kdc[1932](info): preauth ... <cut 6 rows with the same content> (encrypted_timestamp) verify failure: Preauthentication failed Nov 02 09:45:56 ipa31.idm.crp krb5kdc[1932](info): AS_REQ (6 etypes {18 17 20 19 16 23}) 2001:67c:2X70:20X0:d5de:47fa:4de1:b0e7: PREAUTH_FAILED: aae(a)IDM.CRP for krbtgt/IDM.CRP(a)IDM.CRP, Preauthentication failed my thoughts: ... something wrong with etypes, DH size or .... - set pkinit_dh_min_bits = 1024 on the server/client because of heimdal can't use defaults from MIT 2048 DH - tried allow_weak_crypto without success pkgs' versions: MIT 1.15.1 (centos7, freeipa 4.5.0 bundle), heimdal 7.1.0 debian9 based, also was trying 7.4 with the same result MIT KDC and MIT client in the same environment work enough good thanks a lot for your time reading my big message and possible ideas. Oleksandr Yermolenko network/systems engineer

2 1

libsss-sudo
by Andrew Meyer 03 Nov '17

03 Nov '17

When installing FreeIPA (latest) on CentOS 7. If I want to take advantage of IPA sudoers, I need that package correct? Should it not be installed when I install freeipa server/client? Just wondering.

1 1

Can't login with AD credentials on a trust controller
by Ranbir 03 Nov '17

03 Nov '17

Hello Everyone, I have four CentOS 7.3 boxes running ipa that are in a one way trust with an AD domain. Two servers are configured as trust agents and the other two are trust controllers. The trust agents and one trust controller are functioning properly. That is, I can ssh to them and login with my AD credentials, I can use sudo, I can get kerberos tickets, etc. They're working just like I expected them to. The problem is one trust controller won't let me login with my AD credentials. If I login as root and run "id ADaccount(a)domain.tld", I get back the message "no such user". However, I can get kerberos tickets (i.e kinit ADaccount(a)domain.tld) for the AD users so I know at least that part works. I've run "ipa-server-install --uninstall", rebooted, and then installed the server again a couple of times, but I've seen no change. I've checked ports and routes and other basic networking with no glaring issues found. I've seen this error in sssd_nss.log: (Thu Nov 2 09:58:00 2017) [sssd[nss]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 3 errno: 22 error message: Invalid argument (Thu Nov 2 09:58:00 2017) [sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from Data Provider Error: 3, 22, Invalid argument Will try to return what we have in cache And that's about it. AD users are simply not found and I can't figure out why. Does anyone have any ideas on what's wrong? Thanks in advance. -- Ranbir

2 1

mysql and freeipa
by Andrew Meyer 02 Nov '17

02 Nov '17

I am trying to research how to setup MySQL/MariaDB to authenticate against FreeIPA/LDAP. I am running into some issues/confusion. Do I need to add a new user account to tie mysql to? I've been following this website:FreeIPA: Giving permissions to service accounts. — Firstyear's blog-a-log | | | FreeIPA: Giving permissions to service accounts. — Firstyear's blog-a-log Firstyear`s blog-a-log | | | I know that FreeRADIUS is not the same. But has anyone else gotten this to work? We have tons of mysql servers and want our users who need mysql access to have 1 source of authentication.

4 5

RPI2 FreeIPA Installation on Centos 7 not working
by Abraham Cabrera 02 Nov '17

02 Nov '17

As the title implies I've been trying to setup freeipa on a rpi2 with centos 7 arm image for the past few days and no luck. I would like to note this is just for home lab and testing purposes. That being said I can provide logs on request. Below are some of the logs I think can help out. 1. http error log https://pastebin.com/6VviVp6A 2. ipaclient-install.log https://pastebin.com/ZzwVug4a 3. krb5kdc.log https://pastebin.com/4NvFcbtz

3 7

kinit -n
by Charles Hedrick 02 Nov '17

02 Nov '17

I understood that kinit -n is supposed to work with IPA 4.5. I have a server upgraded from 4.4 to 4.5. kinit -n prompts for a password. What needs to be true on client and server for this to work?

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2017