ipa-client-install error on Cloudlinux
by Andrew Radygin
Hello!
I'm trying to install ipa-client on Cloudlinux 7.4, and got following error:
[root@web01-cp ipaplatform]# ipa-client-install
Traceback (most recent call last):
File "/usr/sbin/ipa-client-install", line 22, in <module>
from ipaclient.install import ipa_client_install
File
"/usr/lib/python2.7/site-packages/ipaclient/install/ipa_client_install.py",
line 5, in <module>
from ipaclient.install import client
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line
35, in <module>
from ipalib.install import certmonger, certstore, service, sysrestore
File "/usr/lib/python2.7/site-packages/ipalib/install/certmonger.py",
line 36, in <module>
from ipaplatform.paths import paths
ImportError: cannot import name paths
Of course file of this module is exists:
# ls -l /usr/lib/python2.7/site-packages/ipaplatform/paths.py
-rw-r--r-- 1 root root 17133 ноя 13 11:02
/usr/lib/python2.7/site-packages/ipaplatform/paths.py
# rpm -qa |grep ipa-cl
ipa-client-common-4.5.0-21.el7_4.2.2.cloudlinux.noarch
ipa-client-4.5.0-21.el7_4.2.2.cloudlinux.x86_64
Where I could look more for the debug and possible fix?
Thanks!
--
Best regards, Andrew.
6 years, 4 months
Web UI login fails after upgrading to 4.5
by Marius Bjørnstad
Hi all,
After I upgraded to FreeIPA 4.5 (on CentOS 7), I get an error "Login failed due to an unknown reason" on the web UI, no matter if I use the admin user or my personal user. From what I can tell, all the ipa commands work fine on the command line, and kinit also works fine.
I have included some output from /var/log/httpd/error_log below. It would be great if someone could make a guess (or better) at what is going wrong, or which logs to look at, etc.
When I run the command in the CalledProcessError, I get a password prompt for WELLKNOWN/ANONYMOUS(a)OUS.NSC.LOCAL (the second part is the realm name).
Thanks,
Marius
[Thu Oct 05 11:36:34.898930 2017] [core:notice] [pid 7417] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0
[Thu Oct 05 11:36:34.899649 2017] [suexec:notice] [pid 7417] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Thu Oct 05 11:36:34.899669 2017] [:warn] [pid 7417] NSSSessionCacheTimeout is deprecated. Ignoring.
[Thu Oct 05 11:36:35.065273 2017] [auth_digest:notice] [pid 7417] AH01757: generating secret for digest authentication ...
[Thu Oct 05 11:36:35.065933 2017] [lbmethod_heartbeat:notice] [pid 7417] AH02282: No slotmem from mod_heartmonitor
[Thu Oct 05 11:36:35.065947 2017] [:warn] [pid 7417] NSSSessionCacheTimeout is deprecated. Ignoring.
[Thu Oct 05 11:36:35.100828 2017] [mpm_prefork:notice] [pid 7417] AH00163: Apache/2.4.6 (CentOS) mod_auth_gssapi/1.5.1 mod_nss/1.0.14 NSS/3.28.4 PHP/5.4.16 mod_wsgi/3.4 Python/2.7.5 configured -- resuming normal operations
[Thu Oct 05 11:36:35.100849 2017] [core:notice] [pid 7417] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND'
[Thu Oct 05 11:36:36.676629 2017] [:error] [pid 7424] ipa: INFO: *** PROCESS START ***
[Thu Oct 05 11:36:36.695362 2017] [:error] [pid 7425] ipa: INFO: *** PROCESS START ***
--- login attempt performed now ---
[Thu Oct 05 11:36:38.504718 2017] [:error] [pid 7424] [remote 192.168.1.48:244] mod_wsgi (pid=7424): Exception occurred processing WSGI script '/usr/share/ipa/wsgi.py'.
[Thu Oct 05 11:36:38.504758 2017] [:error] [pid 7424] [remote 192.168.1.48:244] Traceback (most recent call last):
[Thu Oct 05 11:36:38.504776 2017] [:error] [pid 7424] [remote 192.168.1.48:244] File "/usr/share/ipa/wsgi.py", line 51, in application
[Thu Oct 05 11:36:38.504845 2017] [:error] [pid 7424] [remote 192.168.1.48:244] return api.Backend.wsgi_dispatch(environ, start_response)
[Thu Oct 05 11:36:38.504855 2017] [:error] [pid 7424] [remote 192.168.1.48:244] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 262, in __call__
[Thu Oct 05 11:36:38.505045 2017] [:error] [pid 7424] [remote 192.168.1.48:244] return self.route(environ, start_response)
[Thu Oct 05 11:36:38.505054 2017] [:error] [pid 7424] [remote 192.168.1.48:244] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 274, in route
[Thu Oct 05 11:36:38.505067 2017] [:error] [pid 7424] [remote 192.168.1.48:244] return app(environ, start_response)
[Thu Oct 05 11:36:38.505072 2017] [:error] [pid 7424] [remote 192.168.1.48:244] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 929, in __call__
[Thu Oct 05 11:36:38.505079 2017] [:error] [pid 7424] [remote 192.168.1.48:244] self.kinit(user_principal, password, ipa_ccache_name)
[Thu Oct 05 11:36:38.505083 2017] [:error] [pid 7424] [remote 192.168.1.48:244] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 965, in kinit
[Thu Oct 05 11:36:38.505089 2017] [:error] [pid 7424] [remote 192.168.1.48:244] pkinit_anchors=[paths.KDC_CERT, paths.KDC_CA_BUNDLE_PEM],
[Thu Oct 05 11:36:38.505094 2017] [:error] [pid 7424] [remote 192.168.1.48:244] File "/usr/lib/python2.7/site-packages/ipalib/install/kinit.py", line 125, in kinit_armor
[Thu Oct 05 11:36:38.505135 2017] [:error] [pid 7424] [remote 192.168.1.48:244] run(args, env=env, raiseonerr=True, capture_error=True)
[Thu Oct 05 11:36:38.505143 2017] [:error] [pid 7424] [remote 192.168.1.48:244] File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 511, in run
[Thu Oct 05 11:36:38.505346 2017] [:error] [pid 7424] [remote 192.168.1.48:244] raise CalledProcessError(p.returncode, arg_string, str(output))
[Thu Oct 05 11:36:38.505372 2017] [:error] [pid 7424] [remote 192.168.1.48:244] CalledProcessError: Command '/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_7424 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem' returned non-zero exit status 1
6 years, 4 months
sudo auth doesn't work on some hosts
by Andrew Radygin
Hello!
I've got interesting problem,
I have very simple hbac and sudo rules, one hbac for admins group and the
same sudo rule for the same user group - all members of this group could do
anything and everywhere.
I cannot do sudo on some of machines, it's just doesn't accepting password,
but initial login via ssh always successful.
There is no different between hosts where sudo working and where is not,
for freeIPA.
audit log tells me why it's happening:
=========
type=USER_AUTH msg=audit(1512995488.051:15986): pid=30997 uid=50019
auid=50019 ses=2221 msg='op=PAM:authentication grantors=? acct="andreios"
exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=failed'
type=USER_AUTH msg=audit(1512995497.531:15987): pid=30997 uid=50019
auid=50019 ses=2221 msg='op=PAM:authentication grantors=? acct="andreios"
exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=failed'
type=USER_AUTH msg=audit(1512995500.247:15988): pid=30997 uid=50019
auid=50019 ses=2221 msg='op=PAM:authentication grantors=? acct="andreios"
exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=failed'
==========
You see?
op=PAM:authentication grantors=?
On the other hosts it's following:
op=PAM:authentication grantors=pam_succeed_if,pam_succeed_if,pam_sss
Obviously, sudo for whatever reason doesn't try to auth via pam modules,
it's just doesn't seeing them.
sudo debug doesn't tell anything useful:
============
Dec 11 16:22:28 sudo[31666] -> getln @ ./tgetpass.c:303
Dec 11 16:22:33 sudo[31666] <- getln @ ./tgetpass.c:346 := **********
Dec 11 16:22:33 sudo[31666] -> sudo_term_restore_v1 @ ./term.c:112
Dec 11 16:22:33 sudo[31666] <- sudo_term_restore_v1 @ ./term.c:120 := true
Dec 11 16:22:33 sudo[31666] <- tgetpass @ ./tgetpass.c:231 := **********
Dec 11 16:22:35 sudo[31666] -> tgetpass @ ./tgetpass.c:93
Dec 11 16:22:35 sudo[31666] -> tty_present @ ./tgetpass.c:360
Dec 11 16:22:35 sudo[31666] <- tty_present @ ./tgetpass.c:361 := true
Dec 11 16:22:35 sudo[31666] -> sudo_term_noecho_v1 @ ./term.c:130
Dec 11 16:22:35 sudo[31666] <- sudo_term_noecho_v1 @ ./term.c:141 := true
Dec 11 16:22:35 sudo[31666] -> getln @ ./tgetpass.c:303
============
freeipa client installed via ipa-client-install without any errors
OS: Centos 7.3.1611
OS without problems: 7.4.1708, 7.2.1511
So, have anyone idea of what's going happening and why?
Thanks!
--
Best regards, Andrew.
6 years, 4 months
api scripts
by Andrew Meyer
Does anyone have any examples or could share what they have written?
I am trying to write a script and not sure what components I need.
6 years, 4 months
User login is slow to get password prompt
by Alexandre Pitre
Hi,
While troubleshooting "slow login" with ipa users we discovered that adding
these two lines to our clients sssd.conf file fixed our issue for ipa users.
ldap_search_base = cn=accounts,dc=ipa,dc=domain,dc=com
ldap_user_search_base = cn=users,cn=accounts,dc=ipa,dc=domain,dc=com
On the freeipa server side's sssd, we also added, based on the performance
tuning blog post
https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-larg...,
these two parameters.
ignore_group_members = True
subdomain_inherit = ignore_group_members
Without these options and sssd debug enabled, we can see that it goes
through all the trusted AD group to request membership(I think).
Here's a log entry example:
(Mon Dec 18 23:50:49 2017) [sssd[be[ipa.domain.com]]]
[ipa_s2n_get_list_next] (0x0400): Received [testgroup(a)domain.com]
attributes from IPA server.
(Mon Dec 18 23:50:49 2017) [sssd[be[ipa.domain.com]]]
[ipa_s2n_save_objects] (0x0400): Processing group testgroup(a)domain.com
(Mon Dec 18 23:50:49 2017) [sssd[be[ipa.domain.com]]]
[sysdb_search_by_name] (0x0400): No such entry
(Mon Dec 18 23:50:49 2017) [sssd[be[ipa.domain.com]]]
[sysdb_search_by_name] (0x0400): No such entry
(Mon Dec 18 23:50:49 2017) [sssd[be[ipa.domain.com]]]
[sysdb_search_group_by_gid] (0x0400): No such entry
Should ldap_search_base and lda_user_seach_base parameters should be in our
clients sssd per default ? Is that a normal behavior ?
We're also experiencing similar login slowness with our AD trusted
credentials. Do similar parameters exist for a trusted AD realm ?
Thanks for your help.
--
Alexandre Pitre
alexandre.pitre(a)gmail.com
6 years, 4 months
How to deal with 'su root'
by Ronald Wimmer
We have some users that have ALL sudo permissions. What is the best way
of keeping track of all actions they do after having switched to the
root user? Or would it be better to completely prevent switching to the
root user? (if yes, what would be the recommended way of doing that?)
Regards,
Ronald
6 years, 4 months
retrieve user keytab from multiple hosts
by Stijn De Weirdt
hi all,
i'm trying to retrieve an existing keytab from a user on a second host.
ipa-getkeytab on a first host worked fine.
but when i try to retrieve the keytab (using -r option) i get a
"Insufficient access rights" error (even when using admin credentials)
i looked into "ipa service-allow-retrieve-keytab", but it does not
accept the user principal (pretty normal since it's not a service i guess).
hints welcome!
stijn
6 years, 4 months
Unable to use externa groups or users, truster domain object not found
by Henrik Stigendal
Hello everyone,
I’m new to this and are trying to setup a working trust against an AD forrest, I seem to have a working trust but when I try to reference external groups (or users) I get:
# ipa group-add-member ad_users_external --external "AD2\Domain Users"
[member user]:
[member group]:
Group name: ad_users_external
Description: AD users external map
Failed members:
member user:
member group: AD2\Domain Users: trusted domain object not found
-------------------------
Number of members added 0
-------------------------
I enable some logging and last in the mail is the output there from the command above, any suggestions what could cause this? Current version of IPA is 4.5.
Regards
Henrik
Tue Nov 21 13:10:42.675713 2017] [:warn] [pid 38221] [client 192.168.6.82:34714] failed to set perms (3140) on file (/var/run/ipa/ccaches/admin(a)IDM.TEST.NET)!, referer: https://ipaserver.idm.test.net/ipa/xml
string_to_sid: SID AD2\Domain Users is not in a valid format
lpcfg_load: refreshing parameters from /usr/share/ipa/smb.conf.empty
Processing section "[global]"
INFO: Current debug levels:
all: 11
tdb: 11
printdrivers: 11
lanman: 11
smb: 11
rpc_parse: 11
rpc_srv: 11
rpc_cli: 11
passdb: 11
sam: 11
auth: 11
winbind: 11
vfs: 11
idmap: 11
quota: 11
acls: 11
locking: 11
msdfs: 11
dmapi: 11
registry: 11
scavenger: 11
dns: 11
ldb: 11
tevent: 11
pm_process() returned Yes
added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255 netmask=255.255.255.0
added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255 netmask=255.255.255.0
added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255 netmask=255.255.255.0
added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255 netmask=255.255.255.0
added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255 netmask=255.255.255.0
added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255 netmask=255.255.255.0
added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255 netmask=255.255.255.0
added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255 netmask=255.255.255.0
finddcs: searching for a DC by DNS domain ad2.test.net
finddcs: looking for SRV records for _ldap._tcp.ad2.test.net
resolve_lmhosts: Attempting lmhosts lookup for name _ldap._tcp.ad2.test.net<0x0>
getlmhostsent: lmhost entry: 127.0.0.1 localhost
ads_dns_lookup_srv: 2 records returned in the answer section.
ads_dns_parse_rr_srv: Parsed adserver.ad2.test.net [0, 100, 389]
ads_dns_parse_rr_srv: Parsed adserver.ad2.test.net [0, 100, 389]
Addrs = 192.168.5.158@389/adserver,192.168.5.104(a)389/adserver
finddcs: DNS SRV response 0 at '192.168.5.158'
finddcs: DNS SRV response 1 at '192.168.5.104'
finddcs: performing CLDAP query on 192.168.5.158
&response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX
command : LOGON_SAM_LOGON_RESPONSE_EX (23)
sbz : 0x0000 (0)
server_type : 0x0001f1fc (127484)
0: NBT_SERVER_PDC
1: NBT_SERVER_GC
1: NBT_SERVER_LDAP
1: NBT_SERVER_DS
1: NBT_SERVER_KDC
1: NBT_SERVER_TIMESERV
1: NBT_SERVER_CLOSEST
1: NBT_SERVER_WRITABLE
0: NBT_SERVER_GOOD_TIMESERV
0: NBT_SERVER_NDNC
0: NBT_SERVER_SELECT_SECRET_DOMAIN_6
1: NBT_SERVER_FULL_SECRET_DOMAIN_6
1: NBT_SERVER_ADS_WEB_SERVICE
1: NBT_SERVER_DS_8
0: NBT_SERVER_HAS_DNS_NAME
0: NBT_SERVER_IS_DEFAULT_NC
0: NBT_SERVER_FOREST_ROOT
domain_uuid : 63c3a477-85f9-5f01-96e8-2597a5c48978
forest : 'ad2.test.net'
dns_domain : 'ad2.test.net'
pdc_dns_name : 'adserver.ad2.test.net'
domain_name : 'AD2'
pdc_name : 'adserver'
user_name : ''
server_site : 'AS001'
client_site : 'AS002'
sockaddr_size : 0x00 (0)
sockaddr: struct nbt_sockaddr
sockaddr_family : 0x00000000 (0)
pdc_ip : (null)
remaining : DATA_BLOB length=0
next_closest_site : NULL
nt_version : 0x00000005 (5)
1: NETLOGON_NT_VERSION_1
0: NETLOGON_NT_VERSION_5
1: NETLOGON_NT_VERSION_5EX
0: NETLOGON_NT_VERSION_5EX_WITH_IP
0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE
0: NETLOGON_NT_VERSION_AVOID_NT4EMUL
0: NETLOGON_NT_VERSION_PDC
0: NETLOGON_NT_VERSION_IP
0: NETLOGON_NT_VERSION_LOCAL
0: NETLOGON_NT_VERSION_GC
lmnt_token : 0xffff (65535)
lm20_token : 0xffff (65535)
finddcs: Found matching DC 192.168.5.158 with server_type=0x0001f1fc
[Tue Nov 21 13:10:42.740320 2017] [:error] [pid 26496] ipa: INFO: [jsonserver_session] admin(a)IDM.TEST.NET: group_add_member/1(u'ad_users_external', ipaexternalmember=(u'AD2\\\\Domain Users',), version=u'2.228'): SUCCESS
6 years, 4 months
Freeipa connecting to Redhat IPA server.
by Tony Delov
I've been having difficulties connecting a freeipa-client on Ubuntu 16.06
LTS, to a Redhat IPA server that has a trusted connection to Microsoft AD
server.
Ssh authentications are pretty slow, however, once I do get on, I find sudo
commands often do not work for several minutes saying I am not in the "not
in the sudoers file.". This is even though, I am in the same group on the
access.conf file and a sudoers file.
I think the initial slowness is due to the fact that our AD system has lots
of groups and I am part of many large groups with many users. I've been
checking the sssd cache file, and I can see that ssh authentication does
not even start until almost all groups I am a member of have been added to
the cache. However, that does not explain why sudo is being delayed as the
groups are already cached.
Has anyone got any advice about setting up a freeipa-client on Ubuntu to
connect to a Redhat IPA server?
Has anyone else experienced difficulties with sudo commands?
Group membership not listing all the groups a person is a member off all
the time.
id <username>
*IPA Client.*
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=16.04
DISTRIB_CODENAME=xenial
DISTRIB_DESCRIPTION="Ubuntu 16.04.3 LTS"
# dpkg --list | grep freeipa
ii freeipa-client
4.3.1-0ubuntu1 amd64 FreeIPA centralized
identity framework -- client
ii freeipa-common
4.3.1-0ubuntu1 all FreeIPA centralized
identity framework -- common files
*IPA Server*
# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.4 (Maipo)
# rpm -qa | grep "ipa-"
sssd-ipa-1.15.2-50.el7_4.6.x86_64
ipa-common-4.5.0-21.el7_4.2.2.noarch
ipa-server-4.5.0-21.el7_4.2.2.x86_64
ipa-client-common-4.5.0-21.el7_4.2.2.noarch
ipa-client-4.5.0-21.el7_4.2.2.x86_64
ipa-server-common-4.5.0-21.el7_4.2.2.noarch
ipa-server-trust-ad-4.5.0-21.el7_4.2.2.x86_64
Regards
Tony D
6 years, 4 months