Re: Creating a permission to manage OTP Tokens
by Aaron Hicks
Hello the list,
After ignoring things, this now _works_
$kinit helpagent
Password for helpagent(a)TEST.ORG:
$ ipa otptoken-find
--------------------
2 OTP tokens matched
--------------------
Unique ID: otpuser1
Type: TOTP
Owner: otpuser1
Unique ID: otpuser2
Type: TOTP
Owner: otpuser2
----------------------------
Number of entries returned 2
----------------------------
From: Aaron Hicks [mailto:aaron.hicks@nesi.org.nz]
Sent: Thursday, 23 November 2017 10:45 AM
To: 'freeipa-users(a)lists.fedorahosted.org'
<freeipa-users(a)lists.fedorahosted.org>
Subject: Creating a permission to manage OTP Tokens
Hello the list,
We'd like to grant users with the helpdesk role the ability to manipulate
other user's OTP tokens. The minimum would be to add them, delete them, and
enable/disable them.
This is currently possible if an admin sets a token's managedBy attribute
to the helpdesk user's DN. We don't want to grant our helpdesk agents admin
privileges.
So, this is the permission I created:
$ ipa permission-show 'Manage OTP Tokens' --all --raw
dn: cn=Manage OTP Tokens,cn=permissions,cn=pbac,dc=test,dc=org
cn: Manage OTP Tokens
ipapermright: all
ipapermincludedattr: ipatokenOwner
ipapermincludedattr: ipatokenUniqueID
ipapermincludedattr: ipatokenOTPdigits
ipapermincludedattr: ipatokenOTPkey
ipapermincludedattr: ipatokenTOTPclockOffset
ipapermincludedattr: ipatokenTOTPtimeStep
ipapermbindruletype: permission
ipapermlocation: cn=otp,dc=test,dc=org
ipapermtargetfilter: (objectclass=ipaToken)
ipapermissiontype: SYSTEM
ipapermissiontype: V2
aci: (targetattr = "ipatokenOTPdigits || ipatokenOTPkey || ipatokenOwner
|| ipatokenTOTPclockOffset || ipatokenTOTPtimeStep ||
ipatokenUniqueID")(targetfilter = "(objectclass=ipaToken)")(version 3.0;acl
"permission:Manage OTP Tokens";allow (all) groupdn = "ldap:///cn=Manage OTP
Tokens,cn=permissions,cn=pbac,dc=test,dc=org";)
member: cn=Manage OTP Token,cn=privileges,cn=pbac,dc=test,dc=org
memberindirect: cn=helpdesk,cn=roles,cn=accounts,dc=test,dc=org
memberindirect: uid=helpagent,cn=users,cn=accounts,dc=test,dc=org
objectclass: top
objectclass: groupofnames
objectclass: ipapermission
objectclass: ipapermissionv2
However this does not work:
$ kinit helpagent
Password for helpagent(a)TEST.ORG <mailto:helpagent@TEST.ORG> :
$ ipa otptoken-find
--------------------
0 OTP tokens matched
--------------------
----------------------------
Number of entries returned 0
Is there something happening in the back end preventing these permissions
from workin?
Any suggestions?
Regards,
Aaron
6 years, 5 months
Creating a permission to manage OTP Tokens
by Aaron Hicks
Hello the list,
We'd like to grant users with the helpdesk role the ability to manipulate
other user's OTP tokens. The minimum would be to add them, delete them, and
enable/disable them.
This is currently possible if an admin sets a token's managedBy attribute
to the helpdesk user's DN. We don't want to grant our helpdesk agents admin
privileges.
So, this is the permission I created:
$ ipa permission-show 'Manage OTP Tokens' --all --raw
dn: cn=Manage OTP Tokens,cn=permissions,cn=pbac,dc=test,dc=org
cn: Manage OTP Tokens
ipapermright: all
ipapermincludedattr: ipatokenOwner
ipapermincludedattr: ipatokenUniqueID
ipapermincludedattr: ipatokenOTPdigits
ipapermincludedattr: ipatokenOTPkey
ipapermincludedattr: ipatokenTOTPclockOffset
ipapermincludedattr: ipatokenTOTPtimeStep
ipapermbindruletype: permission
ipapermlocation: cn=otp,dc=test,dc=org
ipapermtargetfilter: (objectclass=ipaToken)
ipapermissiontype: SYSTEM
ipapermissiontype: V2
aci: (targetattr = "ipatokenOTPdigits || ipatokenOTPkey || ipatokenOwner
|| ipatokenTOTPclockOffset || ipatokenTOTPtimeStep ||
ipatokenUniqueID")(targetfilter = "(objectclass=ipaToken)")(version 3.0;acl
"permission:Manage OTP Tokens";allow (all) groupdn = "ldap:///cn=Manage OTP
Tokens,cn=permissions,cn=pbac,dc=test,dc=org";)
member: cn=Manage OTP Token,cn=privileges,cn=pbac,dc=test,dc=org
memberindirect: cn=helpdesk,cn=roles,cn=accounts,dc=test,dc=org
memberindirect: uid=helpagent,cn=users,cn=accounts,dc=test,dc=org
objectclass: top
objectclass: groupofnames
objectclass: ipapermission
objectclass: ipapermissionv2
However this does not work:
$ kinit helpagent
Password for helpagent(a)TEST.ORG:
$ ipa otptoken-find
--------------------
0 OTP tokens matched
--------------------
----------------------------
Number of entries returned 0
Is there something happening in the back end preventing these permissions
from workin?
Any suggestions?
Regards,
Aaron
6 years, 5 months
Re: Expired passwords and generating an OTP token
by Aaron Hicks
Hello the List,
This turned out to be a workflow issue, we still have a problem but this
first use case works.
In the case of a user with an invalid password (none or expired) with no OTP
token they can reset their password and ask IPA to create an OTP token for
them.
1. Helpdesk agent uses FreeIPA API passwd method to issue a temporary
password and pass it to the user
2. User uses ssh to login to 2FA host
3. SSH forces user through the reset password process and closes
connection
4. User is not able to login without a OTP Token. A correct result.
5. User uses FreeIPA API otptoken-add method with new password to
generate & receive OTP token
6. User is now able to SSH with password + OTP token.
What isn't working is the case where a user has an invalid token (non,
expired, or just reset) and a valid OTP token.
1. (Optional, but puts user into required state) Helpdesk agent uses
FreeIPA API passwd method to issue a temporary password and pass it to the
user
2. User uses ssh to login to 2FA host, which asks for temporary
password.
3. SSH forces user through reser password process and closes
connection.
4. User is now able to SSH with password + OTP poken
In this case step 2 fails. The reset password process looks like this:
login as: username
Using keyboard-interactive authentication.
Password:
Access denied
Using keyboard-interactive authentication.
Password:
Using keyboard-interactive authentication.
Password expired. Change your password now.
Current Password:
Access denied
The change password process fails.
However, if we disable or delete their OTP token (which requires FreeIPA
admin, not helpdesk role) they're able to reset their password. We don't
want to have to give admin rights to the helpdesk agent for this.
This is also complicated by that the FreeIPA API changes behaviour:
* With an expired/password user can not connect to the API, even to do
passwd to reset password
* With an OTP token, users have to use passwordOTPCODE to access the
API, which means they can't manage their otptoken if they've lost it or want
to disable it so they can reset their password because they forgot it, or
delete it.
Is there a way of allowing users in the helpdesk group/role to be able to
disable/enable or delete OTP tokens? They don't need to see the content,
just allow users to restart the password and token request process.
Is there a fix for the above workflow to allow a user with an OTP token to
reset their password?
Regards,
Aaron Hicks
From: Aaron Hicks [mailto:aaron.hicks@nesi.org.nz]
Sent: Tuesday, 21 November 2017 6:22 PM
To: freeipa-users(a)lists.fedorahosted.org
Subject: Expired passwords and generating an OTP token
Hello the list,
I think this is the last thing to make our terrible user management model
work.
With a helpdesk role via the REST API we can reset a users password, which
is expired, because this is the right thing to do.
These users are expected to log into a node with 2FA using an OTP token
generated by FreeIPA. This works if a user has a valid password and a token.
This is the only machine they have access to, as it's they lander node. They
can not reach the FreeIPA web interface. They can use the FreeIPA API via
our customer management system (CMS) either as them self or as a helpdek
agent on their behalf. The CMS auth is SAML via federated shibboleth, so
does not use our FreeIPA credentials.
However, we have few use cases we need to work:
Can a user generate an OTP token when their password is expired?
Can a a user reset their password when they do not have an OTP token?
Can a user reset their password when they can't log in to get the secret
from thier OTP token?
I think the shortest routes would be:
- if a user could reset an expired password via the FreeIPA API, then use
the otptoken_add method to create one all via our CMS.
- if a user could reset thier password at the ssh login prompt if they have
no token or don't have thier token. Then add a token via our CMS.
Regards,
Aaron
Get Outlook for iOS <https://aka.ms/o0ukef>
6 years, 5 months
Re: FreeIPA-users Digest, Vol 7, Issue 22
by Николай Савельев
>
> I think the better reference in the documentation is
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
>
> If there is a trust to an AD forest and 'ipa-adtrust-install
> --enable-compat' was called. there will be a special sub-tree in
> FreeIPA's LDAP tree cn=compat,dc=ipa,dc=domain. AD user can be searched
> in this sub-tree and if the user was found you can the the DN of the
> user to bind to FreeIPA's LDAP server with the AD password.
>
> Btw, I guess Owncloud supports PAM authentication as well, in this case
> you can just configure Owncloud's PAM module to use SSSD on an IPA
> client and SSSD will do the authentication of AD users for you.
>
> HTH
>
> bye,
> Sumit
>
>> rob
I did 'ipa-adtrust-install --enable-compat'
But in cn=compat,dc=test,dc=loc are only IPA users
How can I insert AD users in cn=compat,dc=test,dc=loc?
--
С уважением, Николай.
6 years, 5 months
Re: Expired passwords and generating an OTP token
by Aaron Hicks
Hi the list.
.I'd consider createing a permission with permission-add, but there is no
token object type.
[hicksaw@hpch2fa02 ~]$ ipa permission-add mangage-otptoken --right=all
--bindtype=permission --type=token
ipa: ERROR: invalid 'type': "token" is not an object type
Even though ipatoken is a valid objectclass
Regards,
Aaron
From: Aaron Hicks [mailto:aaron.hicks@nesi.org.nz]
Sent: Wednesday, 22 November 2017 5:16 PM
To: 'freeipa-users(a)lists.fedorahosted.org'
<freeipa-users(a)lists.fedorahosted.org>
Subject: RE: Expired passwords and generating an OTP token
Hello the List,
This turned out to be a workflow issue, we still have a problem but this
first use case works.
In the case of a user with an invalid password (none or expired) with no OTP
token they can reset their password and ask IPA to create an OTP token for
them.
1. Helpdesk agent uses FreeIPA API passwd method to issue a temporary
password and pass it to the user
2. User uses ssh to login to 2FA host
3. SSH forces user through the reset password process and closes
connection
4. User is not able to login without a OTP Token. A correct result.
5. User uses FreeIPA API otptoken-add method with new password to
generate & receive OTP token
6. User is now able to SSH with password + OTP token.
What isn't working is the case where a user has an invalid token (non,
expired, or just reset) and a valid OTP token.
1. (Optional, but puts user into required state) Helpdesk agent uses
FreeIPA API passwd method to issue a temporary password and pass it to the
user
2. User uses ssh to login to 2FA host, which asks for temporary
password.
3. SSH forces user through reser password process and closes
connection.
4. User is now able to SSH with password + OTP poken
In this case step 2 fails. The reset password process looks like this:
login as: username
Using keyboard-interactive authentication.
Password:
Access denied
Using keyboard-interactive authentication.
Password:
Using keyboard-interactive authentication.
Password expired. Change your password now.
Current Password:
Access denied
The change password process fails.
However, if we disable or delete their OTP token (which requires FreeIPA
admin, not helpdesk role) they're able to reset their password. We don't
want to have to give admin rights to the helpdesk agent for this.
This is also complicated by that the FreeIPA API changes behaviour:
* With an expired/password user can not connect to the API, even to do
passwd to reset password
* With an OTP token, users have to use passwordOTPCODE to access the
API, which means they can't manage their otptoken if they've lost it or want
to disable it so they can reset their password because they forgot it, or
delete it.
Is there a way of allowing users in the helpdesk group/role to be able to
disable/enable or delete OTP tokens? They don't need to see the content,
just allow users to restart the password and token request process.
Is there a fix for the above workflow to allow a user with an OTP token to
reset their password?
Regards,
Aaron Hicks
From: Aaron Hicks [mailto:aaron.hicks@nesi.org.nz]
Sent: Tuesday, 21 November 2017 6:22 PM
To: freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
Subject: Expired passwords and generating an OTP token
Hello the list,
I think this is the last thing to make our terrible user management model
work.
With a helpdesk role via the REST API we can reset a users password, which
is expired, because this is the right thing to do.
These users are expected to log into a node with 2FA using an OTP token
generated by FreeIPA. This works if a user has a valid password and a token.
This is the only machine they have access to, as it's they lander node. They
can not reach the FreeIPA web interface. They can use the FreeIPA API via
our customer management system (CMS) either as them self or as a helpdek
agent on their behalf. The CMS auth is SAML via federated shibboleth, so
does not use our FreeIPA credentials.
However, we have few use cases we need to work:
Can a user generate an OTP token when their password is expired?
Can a a user reset their password when they do not have an OTP token?
Can a user reset their password when they can't log in to get the secret
from thier OTP token?
I think the shortest routes would be:
- if a user could reset an expired password via the FreeIPA API, then use
the otptoken_add method to create one all via our CMS.
- if a user could reset thier password at the ssh login prompt if they have
no token or don't have thier token. Then add a token via our CMS.
Regards,
Aaron
Get Outlook for iOS <https://aka.ms/o0ukef>
6 years, 5 months
adding puppet to FreeIPA
by Andrew Meyer
Ok now I am trying to add puppet to my FreeIPA environment. Following the instructions from: https://www.freeipa.org/page/Howto/Using_FreeIPA_CA_for_Puppet
I am getting the following error:
[root@asm-automation01 ~]# ipa service-add puppetmaster/asm-automation01.mgt.asm.borg.localipa: ERROR: Host 'asm-automation01.mgt.asm.borg.local' does not have corresponding DNS A/AAAA record[root@asm-automation01 ~]# ipa service-add puppetmaster/asm-automation01.mgt.asm.borg.local --forceipa: ERROR: service with name "puppetmaster/asm-automation01.mgt.asm.borg.local(a)MEYER.LOCAL" already exists[root@asm-automation01 ~]# sudo vi /etc/puppetlabs/puppet/puppet.conf[root@asm-automation01 ~]# ipa-getcert request -K puppetmaster/asm-automation01.mgt.asm.borg.local -d /etc/httpd/alias -n puppetmaster/asm-automation01.mgt.asm.borg.localCertificate at same location is already used by request with nickname "20171116140630".[root@asm-automation01 ~]# puppet master --configprint hostcert /var/lib/puppet/ssl/certs/asm-automation01.mgt.asm.borg.local.pem/etc/puppetlabs/puppet/ssl/certs/asm-automation01.mgt.asm.borg.local.pem[root@asm-automation01 ~]# puppet master --configprint hostprivkey /var/lib/puppet/ssl/private_keys/asm-automation01.mgt.asm.borg.local.pem/etc/puppetlabs/puppet/ssl/private_keys/asm-automation01.mgt.asm.borg.local.pem[root@asm-automation01 ~]# puppet master --configprint localcacert /var/lib/puppet/ssl/certs/ca.pem/etc/puppetlabs/puppet/ssl/certs/ca.pem
[root@asm-automation01 ~]# certutil -L -d /etc/pki/nssdb -a -n "IPA Machine Certificate - asm-automation01.mgt.asm.borg.local" > /var/lib/puppet/ssl/certs/asm-automation01.mgt.asm.borg.localcertutil: Could not find cert: IPA Machine Certificate - asm-automation01.mgt.asm.borg.local: PR_FILE_NOT_FOUND_ERROR: File not found[root@asm-automation01 ~]# puppet master --configprint localcacert /var/lib/puppet/ssl/certs/ca.pem/etc/puppetlabs/puppet/ssl/certs/ca.pem[root@asm-automation01 ~]# certutil -L -d /etc/pki/nssdb -a -n "IPA Machine Certificate - asm-automation01.mgt.asm.borg.local" > /var/lib/puppet/ssl/certs/asm-automation01.mgt.asm.borg.localcertutil: Could not find cert: IPA Machine Certificate - asm-automation01.mgt.asm.borg.local: PR_FILE_NOT_FOUND_ERROR: File not found[root@asm-automation01 ~]#
Trying to figure out if my syntax is off. I've created the folders in /var/lib/puppet/ssl/certs.
Thank you,
6 years, 5 months
DNS fails to reply the ipa zone records
by Raul Dias
Bind seems to work fine.
When queried about a record it logs the answer fine (even for external domains).
However it fails to answer any ipa local zone request.
e.g. resolve it own host query:
------------------------------ 8< --------------------------
21-Nov-2017 13:52:06.419 client: debug 3: client 127.0.0.1#58281: UDP request
21-Nov-2017 13:52:06.419 security: debug 3: client 127.0.0.1#58281: request is not signed
21-Nov-2017 13:52:06.419 security: debug 3: client 127.0.0.1#58281: recursion available
21-Nov-2017 13:52:06.419 client: debug 3: client 127.0.0.1#58281: query
21-Nov-2017 13:52:06.420 queries: info: client 127.0.0.1#58281 (freeipa.base.foo.com): query: freeipa.base.foo.com IN A +E (10.10.24.9)
21-Nov-2017 13:52:06.420 security: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): query (cache) 'freeipa.base.foo.com/A/IN' approved
21-Nov-2017 13:52:06.420 client: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): send
21-Nov-2017 13:52:06.420 client: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): sendto
21-Nov-2017 13:52:06.420 client: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): senddone
21-Nov-2017 13:52:06.420 client: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): next
21-Nov-2017 13:52:06.420 client: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): endrequest
---------------------- >8 --------------------------------
$ dig @localhost freeipa.base.foo.com
; <<>> DiG 9.11.1-P3-RedHat-9.11.1-8.P3.fc27 <<>> @localhost freeipa.base.foo.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 16172
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 5c26280e126505660dd1745d5a145292345cd82b68103795 (good)
;; QUESTION SECTION:
;freeipa.base.foo.com. IN A
;; Query time: 2190 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Nov 21 16:21:38 UTC 2017
;; MSG SIZE rcvd: 83
------------------------------ 8< --------------------------
It only happens to the ldap records.
So, what can I do to debug this further?
-rsd
6 years, 5 months
Invalid ticket for NFS4 mount
by Ray
Hi,
yesterday I noticed a strange issue on a Centos 7 client running
ipa-client-4.5.0-21.el7.centos.2.2.x86_64:
My daughter tried to log in to the machine and was kicked out again
after GNOME failed to load (/home on kerberized NFS4). Closer inspection
showed that she had no permission to access her home directory, so GNOME
was unable to read its settings.
This worked before.
I asked her to log into a text console. She got / as her home directory,
as again, she was unable to access her actual home directory.
I checked with klist that she got a ticket. All seemed fine there (TGT
present).
Tried 'cd' again: Permission denied.
Then I asked her to kinit once more. She hacken in her password again
and got a new ticket.
Tried 'cd' again, et voila!: It cding to her NFS4 home directory worked
immediately.
Questions:
- What could be the reason for this behaviour? The box was freshly
booted and I don't see what might have been wrong with the first ticket.
- Where should I look (which logs, etc.) to investigate this further?
Regards,
Ray
6 years, 5 months
Re: Enabling two-factor by host
by Sumit Bose
On Fri, Nov 17, 2017 at 04:09:01AM +0000, Aaron Hicks via FreeIPA-users wrote:
> Hello the list,
>
> Is it possible to enable two-factor authentication using Google Authenticator on FreeIPA on specific hosts or groups of hosts?
>
> Alternatively, are there any recommendations on modifying the Pam configuration on these 2FA required machines to grab the OTP token from FreeIPA when a user logs in?
Please check if authentication indicators is waht you are looking for,
see e.g.
https://blog.delouw.ch/2016/10/16/freeipa-selective-2fa-authentication-in...
for details, look especially for 'Enforcing 2FA on a host principal'.
HTH
bye,
Sumit
>
> Regards,
>
> Aaron
>
> Get Outlook for iOS<https://aka.ms/o0ukef>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
6 years, 5 months