using freeipa with an AWS elastic load balancer
by ridha.zorgui@infor.com
I set up a FreeIPA master and replica behind an elastic load balancer in AWS cloud. FreeIPA Clients will be contacting the replica and the master sever through the load balancer so the dns name used when configurting the clients is the ELB CNAME. The problem is when retreiving ldap data and during the authentication, the SSL handshake fails as the certificate sent back from the master or replica has a hostname different than the one used in the sssd ( the ELB CNAME). so the connection is terminated. There is a workaround which is the use reqcert=allow but this bring a security issue with a MITM attack. another solution i found is the use SAN. I was able to add the ELB DNS as a SAN in freeipa servers certificate. i made sure it is there by downloading the certificate and checking that the elb san exist but when testing it the same problem remain. Please help.
5 years, 1 month
Renewal of External Third Party SSL Cert
by Alka Murali
Hello,
I am using the embedded CA For FreeIPA as well as external CA Signed by
Digicert. However, the certificate will be expiring next month.
After renewal, do I need to install the certificate again using the same
steps mentioned within the link
https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP
Similarly how will I be able to update the new certificate in my IPA
Clients too. Do I need to follow the steps below on all IPA Clients?
-----
certutil -A -d /etc/pki/nssdb -n 'IPA CA' -t CT,C,C -a -i ipa.crt
cp ipa.crt /etc/ipa/ca.crt
-------
Can you please brief up the exact procedure to follow for the third party
SSL cert renewal.
Thanks and Regards,
Alka Murali
5 years, 12 months
Can't create new CA replica
by john.bowman@zayo.com
Since taking over our FreeIPA environment I've been unable to create a new CA replica. A bunch of failed attempts and upgrades over the last year and I keep running in to issues. After my latest attempt I noticed something that I had not seen before (likely a result of an recent upgrade) and I was wondering if this would cause a CA install to fail.
Our env:
3 x ipa-server-3.0.0-51.el6.x86_64
3 x ipa-server-4.4.0-14.el7_3.7.x86_64
2 of the 3.x IPA servers are currently acting as CAs and I've been trying to create a new 4.x CA replica in order to start removing the 3.x IPA servers. I've been able to do a simple test with vanilla CentOS 6.9 and 7.3 and it seems to work fine as far as I can tell but when I try it in our environment it fails. I noticed this error in one of the logs and something jumped out at me that I had never seen before:
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: === Finalization ===
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Updating existing security domain
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: isSDHostDomainMaster(): Getting domain.xml from CA...
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: getting domain info
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: GET https://ipa-master.domain.tld:443/ca/admin/ca/getDomainXML
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: status: 0
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: domain info: <?xml version="1.0" encoding="UTF-8" standalone="no"?><DomainInfo><Name>IPA</Name><CAList><CA
><Host>ipa-master.domain.tld</Host><SecurePort>443</SecurePort><SecureAgentPort>443</SecureAgentPort><SecureAdminPort>443</SecureAdminPort><UnSecurePort>80</UnSecurePort><Sec
ureEEClientAuthPort>443</SecureEEClientAuthPort><DomainManager>TRUE</DomainManager><Clone>TRUE</Clone><SubsystemName>pki-cad</SubsystemName></CA><CA><Host>ipa-replica1.domain.tld
</Host><SecurePort>443</SecurePort><SecureAgentPort>443</SecureAgentPort><SecureAdminPort>443</SecureAdminPort><UnSecurePort>80</UnSecurePort><SecureEEClientAuthPort>443</S
ecureEEClientAuthPort><DomainManager>TRUE</DomainManager><Clone>TRUE</Clone><SubsystemName>pki-cad</SubsystemName></CA><CA><Host>ipa-replica2.domain.tld</Host><SecurePort>443</Se
curePort><SecureAgentPort>443</SecureAgentPort><SecureAdminPort>443</SecureAdminPort><UnSecurePort>80</UnSecurePort><SecureEEClientAuthPort>443</SecureEEClientAuthPort><Dom
ainManager>TRUE</DomainManager><Clone>TRUE</Clone><SubsystemName>pki-cad</SubsystemName></CA><SubsystemCount>3</SubsystemCount></CAList><OCSPList><SubsystemCount>0</Subsyst
emCount></OCSPList><KRAList><SubsystemCount>0</SubsystemCount></KRAList><RAList><SubsystemCount>0</SubsystemCount></RAList><TKSList><SubsystemCount>0</SubsystemCount></TKSL
ist><TPSList><SubsystemCount>0</SubsystemCount></TPSList></DomainInfo>
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Cloning a domain master
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Update security domain using admin interface
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: updateDomainXML start hostname=ipa-master.domain.tld port=443
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: POST https://ipa-master.domain.tld:443/ca/admin/ca/updateDomainXML
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Unable to access admin interface: javax.ws.rs.NotFoundException: HTTP 404 Not Found
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Update security domain using agent interface
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: updateDomainXML start hostname=ipa-master.domain.tld port=443
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: updateDomainXML() nickname=subsystemCert cert-pki-ca
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: POST https://ipa-master.domain.tld:443/ca/agent/ca/updateDomainXML
[14/Jun/2017:06:49:45][http-bio-8443-exec-3]: Server certificate:
[14/Jun/2017:06:49:45][http-bio-8443-exec-3]: - subject: CN=ipa-master.domain.tld,O=DOMAIN.US
[14/Jun/2017:06:49:45][http-bio-8443-exec-3]: - issuer: CN=Certificate Authority,O=DOMAIN.US
[14/Jun/2017:06:49:45][http-bio-8443-exec-3]: ConfigurationUtils: updateDomainXML: status=1
[14/Jun/2017:06:49:45][http-bio-8443-exec-3]: Unable to update security domain: 2
java.io.IOException: Unable to update security domain: 2
The ipa-master.domain.tld is one of the current RHEL 6.9 FreeIPA 3.x servers but the other two listed in that domainxml file one does not exist (it may have at some point been renamed) and the other server is not a CA replica but it is a replica.
Is it possible this bad info would cause a failure when trying to create a new CA replica? If so is it something I can try cleaning up?
Any info would be appreciated. Thanks!
6 years
AD trust setup woes
by Jason Beck
I have been trying to reliably get an AD trust setup for a few weeks and no
matter what I try, when I goto add AD users to an external group in
FreeIPA, I get:
"trusted domain object not found"
Googling around tends to always yield the same suggestions:
1) Check time sync
2) Check DNS
3) Check firewall
I have done all of this ad nauseam in several different environments with
several different versions of FreeIPA and Windows servers. I have gotten a
setup to work maybe 2% of the time out of hundreds of attempts.
I am currently using FreeIPA 4.5.2 on Fedora 25 (out of the COPR repo). I
am trying to establish trust with a mixed Windows 2012 & 2008 forest. I
have tried both one and two way trusts. Everything seems to work fine up
until I try to add AD users to FreeIPA.
I have verified all of the requisite DNS records exist and return the
proper information on both sides, there are no firewalls between any of the
hosts, and the AD servers and FreeIPA servers are synchronized by the same
NTP servers.
What could I possibly be missing?
6 years, 2 months
Cannot access Web UI after IPA upgrade to 4.5
by Gustavo Berman
Hi there,
Today we upgraded to the latest IPA 4.5, log says it upgraded just fine,
ipa seems to authenticate allright, but web ui fails with:
Operations ErrorSome operations failed.an internal error has occurred
And the details it shows when I press the OK button are:
Runtime error
Web UI got in unrecoverable state during "profile" phase.
Technical details:
t.metadata is undefined
update_logged_in@https://ipaserver.fisica.cabib/ipa/ui/
js/freeipa/app.js?40500:1:18156 choose_profile@https://
ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:16651
register_phases/
<https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:16651regi...>
<@https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:1181
_run_phase/
<https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:1181_run_...>
<@https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:3476
forEach@https://ipaserver.fisica.cabib/ipa/ui/js/dojo/
dojo.js?v=40500:1:29752 _run_phase@https://ipaserver.fisica.cabib/ipa/ui/js/
freeipa/app.js?40500:1:3440 next_phase@https://ipaserver.
fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:3899 _run_phase/
<https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:3899_run_...>
<@https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:3626 c@
https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:60960
d/t.then@https://ipaserver.fisica.cabib/ipa/ui/js/dojo/
dojo.js?v=40500:1:62246
<https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:60960d/t....>
_run_phase@https://ipaserver.fisica.cabib/ipa/ui/js/
freeipa/app.js?40500:1:3548 next_phase@https://ipaserver.
fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:3899 _run_phase/
<https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:3899_run_...>
<@https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:3626 c@
https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:60960 l@
https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:60886
d/this.resolve@https://ipaserver.fisica.cabib/ipa/ui/
js/dojo/dojo.js?v=40500:1:61873 dojo/promise/all/
<https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:60886d/th...>
</</</<@https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:
85255 c@https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?
v=40500:1:60960
l@https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:60886
d/this.resolve@https://ipaserver.fisica.cabib/ipa/ui/
js/dojo/dojo.js?v=40500:1:61873 register_phases/
<https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:60886d/th...>
</<@https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:1092
on_success@https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:34431
freeipa/rpc/
<https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:34431free...>
</a.concurrent_command/t.on_success_all@https://ipaserver.fisica.cabib/ipa/
ui/js/freeipa/app.js?40500:1:57160 freeipa/rpc/
<https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:57160free...>
</a.concurrent_command/t.command_completed@https://ipaserver.fisica.cabib/
ipa/ui/js/freeipa/app.js?40500:1:56953 freeipa/rpc/
<https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:56953free...>
</a.concurrent_command/t.success_handler@https://ipaserver.fisica.cabib/
ipa/ui/js/freeipa/app.js?40500:1:56790 freeipa/rpc/
<https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:56790free...>
</a.concurrent_command/t.execute/n.on_success</<@https://ipaserver.
fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:56340 freeipa/rpc/
<https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:56340free...>
</a.command/l.register_handlers/<@https://ipaserver.fisica.cabib/ipa/ui/
js/freeipa/app.js?40500:1:53786 f@https://ipaserver.fisica.
cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:49586 dojo/on/
<https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:49586dojo...>
</i.emit@https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:45192
dojo/on/
<https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:45192dojo...>
</i.emit@https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:
45808 emit@https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?
v=40500:1:48712 c@https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.
js?40500:1:52429 l@https://ipaserver.fisica.cabib/ipa/ui/js/libs/jquery.
js?v=40500:4:24877 fireWith@https://ipaserver.fisica.cabib/ipa/ui/js/libs/
jquery.js?v=40500:4:25702 k@https://ipaserver.fisica.
cabib/ipa/ui/js/libs/jquery.js?v=40500:6:5346 t/
<https://ipaserver.fisica.cabib/ipa/ui/js/libs/jquery.js?v=40500:6:5346t/><@
https://ipaserver.fisica.cabib/ipa/ui/js/libs/jquery.js?v=40500:6:9152
Apache error logs shows:
[Mon Aug 07 11:04:32.078630 2017] [:warn] [pid 11845] [client
##.##.##.##:45938] failed to set perms (3140) on file
(/var/run/ipa/ccaches/tavo(a)FISICA.CABIB)!, referer:
https://ipaserver.fisica.cabib/ipa/ui/
[Mon Aug 07 11:04:32.079589 2017] [:error] [pid 11839] ipa: DEBUG: WSGI
wsgi_dispatch.__call__:
[Mon Aug 07 11:04:32.079709 2017] [:error] [pid 11839] ipa: DEBUG: WSGI
jsonserver_session.__call__:
[Mon Aug 07 11:04:32.160389 2017] [:error] [pid 11839] ipa: DEBUG: Created
connection context.ldap2_94603036533520
[Mon Aug 07 11:04:32.160485 2017] [:error] [pid 11839] ipa: DEBUG: WSGI
jsonserver.__call__:
[Mon Aug 07 11:04:32.160577 2017] [:error] [pid 11839] ipa: DEBUG: WSGI
WSGIExecutioner.__call__:
[Mon Aug 07 11:04:32.170494 2017] [:error] [pid 11839] ipa: DEBUG: raw:
batch(({u'params': ([], {}), u'method': u'i18n_messages'}, {u'params': ([],
{}), u'method': u'config_show'}, {u'params': ([], {}), u'method':
u'whoami'}, {u'params': ([], {}), u'method': u'env'}, {u'params': ([], {}),
u'method': u'dns_is_enabled'}, {u'params': ([], {}), u'method':
u'trustconfig_show'}, {u'params': ([], {}), u'method': u'domainlevel_get'},
{u'params': ([], {}), u'method': u'ca_is_enabled'}, {u'params': ([], {}),
u'method': u'vaultconfig_show'}), version=u'2.228')
[Mon Aug 07 11:04:32.170764 2017] [:error] [pid 11839] ipa: DEBUG:
batch(({u'params': ([], {}), u'method': u'i18n_messages'}, {u'params': ([],
{}), u'method': u'config_show'}, {u'params': ([], {}), u'method':
u'whoami'}, {u'params': ([], {}), u'method': u'env'}, {u'params': ([], {}),
u'method': u'dns_is_enabled'}, {u'params': ([], {}), u'method':
u'trustconfig_show'}, {u'params': ([], {}), u'method': u'domainlevel_get'},
{u'params': ([], {}), u'method': u'ca_is_enabled'}, {u'params': ([], {}),
u'method': u'vaultconfig_show'}), version=u'2.228')
[Mon Aug 07 11:04:32.171033 2017] [:error] [pid 11839] ipa: DEBUG: raw:
i18n_messages(version=u'2.228')
[Mon Aug 07 11:04:32.171215 2017] [:error] [pid 11839] ipa: DEBUG:
i18n_messages(version=u'2.228')
[Mon Aug 07 11:04:32.178630 2017] [:error] [pid 11839] ipa: INFO:
tavo(a)FISICA.CABIB: batch: i18n_messages(): SUCCESS
[Mon Aug 07 11:04:32.178857 2017] [:error] [pid 11839] ipa: DEBUG: raw:
config_show(version=u'2.228')
[Mon Aug 07 11:04:32.179094 2017] [:error] [pid 11839] ipa: DEBUG:
config_show(rights=False, all=False, raw=False, version=u'2.228')
[Mon Aug 07 11:04:32.181775 2017] [:error] [pid 11839] ipa: DEBUG:
retrieving schema for SchemaCache
url=ldapi://%2fvar%2frun%2fslapd-FISICA-CABIB.socket
conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x560a7e36a0e0>
[Mon Aug 07 11:04:32.548227 2017] [:error] [pid 11839] ipa: INFO:
tavo(a)FISICA.CABIB: batch: config_show(): SUCCESS
[Mon Aug 07 11:04:32.548454 2017] [:error] [pid 11839] ipa: DEBUG: raw:
whoami(version=u'2.228')
[Mon Aug 07 11:04:32.548625 2017] [:error] [pid 11839] ipa: DEBUG:
whoami(version=u'2.228')
[Mon Aug 07 11:04:32.549205 2017] [:error] [pid 11839] ipa: INFO:
tavo(a)FISICA.CABIB: batch: whoami(): PROTOCOL_ERROR
[Mon Aug 07 11:04:32.549456 2017] [:error] [pid 11839] ipa: DEBUG: raw:
env(None, version=u'2.228')
[Mon Aug 07 11:04:32.549700 2017] [:error] [pid 11839] ipa: DEBUG:
env(None, server=False, all=True, version=u'2.228')
[Mon Aug 07 11:04:32.550139 2017] [:error] [pid 11839] ipa: INFO:
tavo(a)FISICA.CABIB: batch: env(None): SUCCESS
[Mon Aug 07 11:04:32.550350 2017] [:error] [pid 11839] ipa: DEBUG: raw:
dns_is_enabled(version=u'2.228')
[Mon Aug 07 11:04:32.550520 2017] [:error] [pid 11839] ipa: DEBUG:
dns_is_enabled(version=u'2.228')
[Mon Aug 07 11:04:32.552209 2017] [:error] [pid 11839] ipa: INFO:
tavo(a)FISICA.CABIB: batch: dns_is_enabled(): SUCCESS
[Mon Aug 07 11:04:32.552435 2017] [:error] [pid 11839] ipa: DEBUG: raw:
trustconfig_show(version=u'2.228')
[Mon Aug 07 11:04:32.552742 2017] [:error] [pid 11839] ipa: DEBUG:
trustconfig_show(rights=False, trust_type=u'ad', all=False, raw=False,
version=u'2.228')
[Mon Aug 07 11:04:32.558903 2017] [:error] [pid 11839] ipa: INFO:
tavo(a)FISICA.CABIB: batch: trustconfig_show(): SUCCESS
[Mon Aug 07 11:04:32.559101 2017] [:error] [pid 11839] ipa: DEBUG: raw:
domainlevel_get(version=u'2.228')
[Mon Aug 07 11:04:32.559292 2017] [:error] [pid 11839] ipa: DEBUG:
domainlevel_get(version=u'2.228')
[Mon Aug 07 11:04:32.560543 2017] [:error] [pid 11839] ipa: INFO:
tavo(a)FISICA.CABIB: batch: domainlevel_get(): SUCCESS
[Mon Aug 07 11:04:32.560753 2017] [:error] [pid 11839] ipa: DEBUG: raw:
ca_is_enabled(version=u'2.228')
[Mon Aug 07 11:04:32.560924 2017] [:error] [pid 11839] ipa: DEBUG:
ca_is_enabled(version=u'2.228')
[Mon Aug 07 11:04:32.562484 2017] [:error] [pid 11839] ipa: INFO:
tavo(a)FISICA.CABIB: batch: ca_is_enabled(): SUCCESS
[Mon Aug 07 11:04:32.562694 2017] [:error] [pid 11839] ipa: DEBUG: raw:
vaultconfig_show(version=u'2.228')
[Mon Aug 07 11:04:32.562880 2017] [:error] [pid 11839] ipa: DEBUG:
vaultconfig_show(all=False, raw=False, version=u'2.228')
[Mon Aug 07 11:04:32.563089 2017] [:error] [pid 11839] ipa: DEBUG: raw:
kra_is_enabled(version=u'2.228')
[Mon Aug 07 11:04:32.563209 2017] [:error] [pid 11839] ipa: DEBUG:
kra_is_enabled(version=u'2.228')
[Mon Aug 07 11:04:32.564192 2017] [:error] [pid 11839] ipa: INFO:
tavo(a)FISICA.CABIB: batch: vaultconfig_show(): InvocationError
[Mon Aug 07 11:04:32.564462 2017] [:error] [pid 11839] ipa: INFO:
[jsonserver_session] tavo(a)FISICA.CABIB: batch(({u'params': ([], {}),
u'method': u'i18n_messages'}, {u'params': ([], {}), u'method':
u'config_show'}, {u'params': ([], {}), u'method': u'whoami'}, {u'params':
([], {}), u'method': u'env'}, {u'params': ([], {}), u'method':
u'dns_is_enabled'}, {u'params': ([], {}), u'method': u'trustconfig_show'},
{u'params': ([], {}), u'method': u'domainlevel_get'}, {u'params': ([], {}),
u'method': u'ca_is_enabled'}, {u'params': ([], {}), u'method':
u'vaultconfig_show'}), version=u'2.228'): SUCCESS
[Mon Aug 07 11:04:32.567156 2017] [:error] [pid 11839] ipa: DEBUG:
Destroyed connection context.ldap2_94603036533520
From the first line of apache log the file it refers to has this attributes:
stat /var/run/ipa/ccaches/tavo(a)FISICA.CABIB
File: ‘/var/run/ipa/ccaches/tavo(a)FISICA.xn--cabib-3v3b
Size: 4596 Blocks: 16 IO Block: 4096 regular file
Device: 12h/18d Inode: 37651 Links: 1
Access: (0600/-rw-------) Uid: ( 989/ ipaapi) Gid: ( 985/ ipaapi)
Context: system_u:object_r:ipa_var_run_t:s0
Access: 2017-08-07 11:09:56.260676960 -0300
Modify: 2017-08-07 09:58:09.367597633 -0300
Change: 2017-08-07 09:58:09.367597633 -0300
Birth: -
This are the ipa packages I have:
rpm -qa | grep ipa
python2-ipaclient-4.5.0-21.el7.noarch
python-iniparse-0.4-9.el7.noarch
sssd-ipa-1.15.2-50.el7.x86_64
ipa-client-4.5.0-21.el7.x86_64
python2-ipaserver-4.5.0-21.el7.noarch
python-libipa_hbac-1.15.2-50.el7.x86_64
ipa-common-4.5.0-21.el7.noarch
ipa-server-4.5.0-21.el7.x86_64
ipa-server-common-4.5.0-21.el7.noarch
ipa-server-dns-4.5.0-21.el7.noarch
python-ipaddress-1.0.16-2.el7.noarch
ipa-python-compat-4.5.0-21.el7.noarch
ipa-client-common-4.5.0-21.el7.noarch
libipa_hbac-1.15.2-50.el7.x86_64
python2-ipalib-4.5.0-21.el7.noarch
Any ideas?
Thanks!
--
Gustavo Berman
Sysadmin - Gerencia de Física - Centro Atómico Bariloche - CNEA
6 years, 2 months
Radius authentication trouble
by Steve Weeks
We are running FreeIPA 4.4 on Centos 7 and trying to use radius
authentication.
Using radtest and radclient work fine and we can authenticate a user.
The radius proxy and secret are set to match the values from radclient.
The user has the radius check box checked and the other two fields set to
appropriate values. hbactest shows that the user has permission for any
host.
When I do " su -l rsa-user", I'm requested for the first and second
factors. After I enter them, I get "su: Authentication failure". Using a
non-radius user works fine.
The sssd_pam log has
[sssd[pam]] [pam_dp_process_reply] (0x0200): received: [17 (Failure setting
user credentials)][idm.bbn.com]
[sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [17]:
Failure setting user credentials.
Unchecking the radius checkbox and the account works fine.
Any ideas what to try or look at next?
6 years, 2 months
Kvno error on validating one-way trust: "kvno: Decrypt integrity check failed while getting credentials"
by bogusmaster@o2.pl
Hi All,
I am setting up a one-way trust from FreeIPA server to AD domain with a pre-shared key.
It seems that it was set up successfully but I cannot verify the Kerberos configuration when I follow the steps described here: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/....
Although I successfuly kinit with a username from AD domain and obtain a ticket:
klist
Ticket cache: KEYRING:persistent:0:0
Default principal: testuser(a)DOMAIN.COM
Valid starting Expires Service principal
08/22/2017 09:47:41 08/22/2017 19:47:41 krbtgt/DOMAIN.COM(a)DOMAIN.COM
renew until 08/23/2017 09:47:34
I am not able to request service tickets for a service within IdM domain:
[root@idm1 ~]# KRB5_TRACE=/dev/stdout kvno -S host idm1.ipa.domain.com
[16119] 1503409696.153004: Getting credentials testuser(a)DOMAIN.COM -> host/idm1.ipa.domain.com(a)IPA.DOMAIN.COM using ccache KEYRING:persistent:0:0
[16119] 1503409696.153288: Retrieving testuser(a)DOMAIN.COM -> host/idm1.ipa.domain.com(a)IPA.DOMAIN.COM from KEYRING:persistent:0:0 with result: -1765328243/Matching credential not found
[16119] 1503409696.153422: Retrieving testuser(a)DOMAIN.COM -> krbtgt/IPA.DOMAIN.COM(a)IPA.DOMAIN.COM from KEYRING:persistent:0:0 with result: -1765328243/Matching credential not found
[16119] 1503409696.153520: Retrieving testuser(a)DOMAIN.COM -> krbtgt/DOMAIN.COM(a)DOMAIN.COM from KEYRING:persistent:0:0 with result: 0/Success
[16119] 1503409696.153536: Starting with TGT for client realm: testuser(a)DOMAIN.COM -> krbtgt/DOMAIN.COM(a)DOMAIN.COM
[16119] 1503409696.153600: Retrieving testuser(a)DOMAIN.COM -> krbtgt/IPA.DOMAIN.COM(a)IPA.DOMAIN.COM from KEYRING:persistent:0:0 with result: -1765328243/Matching credential not found
[16119] 1503409696.153609: Requesting TGT krbtgt/IPA.DOMAIN.COM(a)DOMAIN.COM using TGT krbtgt/DOMAIN.COM(a)DOMAIN.COM
[16119] 1503409696.153663: Generated subkey for TGS request: aes256-cts/A13D
[16119] 1503409696.153718: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts, des-cbc-crc, des, des-cbc-md4
[16119] 1503409696.153875: Encoding request body and padata into FAST request
[16119] 1503409696.153942: Sending request (1851 bytes) to DOMAIN.COM
[16119] 1503409696.154236: Resolving hostname domain.com
[16119] 1503409696.290796: Initiating TCP connection to stream 10.10.10.10:88
[16119] 1503409696.398086: Sending TCP request to stream 10.10.10.10:88
[16119] 1503409696.836098: Received answer (1551 bytes) from stream 10.10.10.10:88
[16119] 1503409696.836121: Terminating TCP connection to stream 10.10.10.10:88
[16119] 1503409696.836212: Response was from master KDC
[16119] 1503409696.836258: Decoding FAST response
[16119] 1503409696.836423: TGS reply is for testuser(a)DOMAIN.COM -> krbtgt/ipa.domain.com(a)DOMAIN.COM with session key aes256-cts/C0B1
[16119] 1503409696.836454: TGS request result: 0/Success
[16119] 1503409696.836461: Received TGT for offpath realm ipa.domain.com
[16119] 1503409696.836468: Requesting TGT krbtgt/IPA.DOMAIN.COM(a)ipa.domain.com using TGT krbtgt/ipa.domain.com(a)DOMAIN.COM
[16119] 1503409696.836486: Generated subkey for TGS request: aes256-cts/743D
[16119] 1503409696.836523: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts, des-cbc-crc, des, des-cbc-md4
[16119] 1503409696.836579: Encoding request body and padata into FAST request
[16119] 1503409696.836648: Sending request (1854 bytes) to ipa.domain.com
[16119] 1503409696.904352: Resolving hostname idm1.ipa.domain.com.
[16119] 1503409696.938147: Sending initial UDP request to dgram 10.10.10.11:88
[16119] 1503409696.943465: Received answer (146 bytes) from dgram 10.10.10.11:88
[16119] 1503409696.977047: Response was from master KDC
[16119] 1503409696.977102: TGS request result: -1765328353/Decrypt integrity check failed
kvno: Decrypt integrity check failed while getting credentials for host/idm1.ipa.domain.com(a)IPA.DOMAIN.COM
Can you please advise me on how to resolve this issue?
Bart
6 years, 2 months
Re: Krb5.conf only sees first two kdc servers
by pgb205
Sumit, thank you very much for this. Very helpful, but I am still not seeing the problem
So at first I will try with the following in krb5.confkdc=server1 <--shut off on the network#kdc=server2 <--shut off on the network and commented out in krb5.confkdc=server3 <--up and running
KRB5_TRACE=/dev/stdout kinit user(a)test.domain
[12583] 1501113245.556036: Getting initial credentials for user(a)test.domain
[12583] 1501113245.556244: Sending request (181 bytes) to test.domain
[12583] 1501113245.556282: Resolving hostname server1
[12583] 1501113245.557235: Sending initial UDP request to dgram ip_addr_server1:88
[12583] 1501113246.558328: Resolving hostname server3
[12583] 1501113246.558974: Sending initial UDP request to dgram ip_addr_server3:88
[12583] 1501113246.729059: Received answer (275 bytes) from dgram ip_addr_server3:88
[12583] 1501113246.729111: Response was from master KDC
[12583] 1501113246.729155: Received error from KDC: -1765328359/Additional pre-authentication required
[12583] 1501113246.729219: Processing preauth types: 136, 19, 2, 133
[12583] 1501113246.729245: Selected etype info: etype aes256-cts, salt "pY;=XB+5_*EjJC%S", params ""
[12583] 1501113246.729254: Received cookie: MIT
Password for user(a)test.domain <--get prompted for password
Now with all three kdc uncommentedkdc=server1 <-shut off and uncommentedkdc=server2 <--shut off and uncommentedkdc=server3 <--up and running
KRB5_TRACE=/dev/stdout kinit user(a)test.domain
[12536] 1501112935.251721: Getting initial credentials for user(a)test.domain
[12536] 1501112935.251917: Sending request (181 bytes) to test.domain
[12536] 1501112935.251956: Resolving hostname server1
[12536] 1501112935.252875: Sending initial UDP request to dgram server1_ip:88
[12536] 1501112936.253962: Resolving hostname server2
[12536] 1501112936.255680: Retrying AS request with master KDC
[12536] 1501112936.255699: Getting initial credentials for user(a)test.domain
[12536] 1501112936.255763: Sending request (181 bytes) to test.domain (master)
[12536] 1501112936.255779: Resolving hostname server1
[12536] 1501112936.256379: Sending initial UDP request to dgram server1_ip:88
[12536] 1501112937.257451: Resolving hostname server2
kinit: Invalid argument while getting initial credentials
>
So as you can see server3 is never even tried for authentication. One of my theories is that there might be maximum number of kdc's to tryor maximum total authentication timeout?! Just a wild guess as I'm reaching for straws.
-------------------------------My other question with regards to how sssd and krb work together was prompted by sssd.confipa_server= _srv_ option which supposed to find available IPA servers from DNS records. We do indeed have this option set in sssd.confand are able to resolve server1,server2 server3 when querying for following records
_ldap._tcp _kerberos._tcp _kerberos._udp _kerberos-master._tcp _kerberos-master._udp _ntp._udp
If the _srv_ is enabled then am i correct in assuming that we wouldn't even need kdc= records in krb5.conf ??I tried removing kdc= linesand was unable to authenticate.
6 years, 2 months
Unable to create an Active Directory Trust
by PAESSENS Daniel (BCS/PSD)
Hello,
When performing a trust between IPA & AD I get the following error:
CIFS server communication error: code "-1073741771", message "The object name already exists." (both may be "None")
For testing purpose did I remove the trust and want to re-add him like before.
Regards,
Daniel
________________________________
**** DISCLAIMER****
http://www.bics.com/maildisclaimer/
6 years, 2 months
FreeIPA failover not working
by Michael Gusek
Hi,
we are testing a FreeIPA trust to an Active Directory. Trust itself
works, we are happy. Now we tested a failure on FreeIPA site. We have
two instances, both with same roles. If we poweroff first installed
server, and clean sssd caches with restart of sssd on client side , sssd
service can’t establish a connection to second instance.
ipa-lx-test-01.ipa.example.com is the first installed FreeIPA with
ipa-server-4.4.0-14.el7.centos.7.x86_64 on latest CentOS7
ipa-lx-test-02.ipa.example.com is the second installed FreeIPA with
ipa-server-4.4.0-14.el7.centos.7.x86_64 on latest CentOS7
ipa-lx-test-debian9.ipa.example.com is a latest Debian 9.1 with sssd
1.15.0-3
For deeper inspection full log is attached. In logs we found something
like this:
|(Wed Aug 23 16:07:06 2017) [sssd[be[ipa.example.com]]]
[set_server_common_status] (0x0100): Marking server
'ipa-lx-test-01.ipa.example.com' as 'name resolved' (Wed Aug 23 16:07:06
2017) [sssd[be[ipa.example.com]]] [be_resolve_server_process] (0x1000):
Saving the first resolved server (Wed Aug 23 16:07:06 2017)
[sssd[be[ipa.example.com]]] [be_resolve_server_process] (0x0200): Found
address for server ipa-lx-test-01.ipa.example.com: [x.x.x.x] TTL 1200
(Wed Aug 23 16:07:06 2017) [sssd[be[ipa.example.com]]]
[ipa_resolve_callback] (0x0400): Constructed uri
'ldap://ipa-lx-test-01.ipa.example.com' (Wed Aug 23 16:07:06 2017)
[sssd[be[ipa.example.com]]] [unique_filename_destructor] (0x2000):
Unlinking [/var/lib/sss/pubconf/.krb5info_dummy_2zXOse] (Wed Aug 23
16:07:06 2017) [sssd[be[ipa.example.com]]] [unlink_dbg] (0x2000): File
already removed: [/var/lib/sss/pubconf/.krb5info_dummy_2zXOse] (Wed Aug
23 16:07:06 2017) [sssd[be[ipa.example.com]]]
[sssd_async_socket_init_send] (0x4000): Using file descriptor [19] for
the connection. (Wed Aug 23 16:07:06 2017) [sssd[be[ipa.example.com]]]
[sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for
connecting (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[sssd_async_connect_done] (0x0020): connect failed [113][Keine Route zum
Zielrechner]. (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[sssd_async_socket_init_done] (0x0020): sdap_async_sys_connect request
failed: [113]: Keine Route zum Zielrechner. (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [sssd_async_socket_state_destructor]
(0x0400): closing socket [19] (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [sss_ldap_init_sys_connect_done] (0x0020):
sssd_async_socket_init request failed: [113]: Keine Route zum
Zielrechner. (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[sdap_sys_connect_done] (0x0020): sdap_async_connect_call request
failed: [113]: Keine Route zum Zielrechner. (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [sdap_handle_release] (0x2000): Trace:
sh[0x558252c36770], connected[0], ops[(nil)], ldap[(nil)],
destructor_lock[0], release_memory[0] (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [_be_fo_set_port_status] (0x8000): Setting
status: PORT_NOT_WORKING. Called from:
../src/providers/ldap/sdap_async_connection.c: sdap_cli_connect_done:
1572 (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[fo_set_port_status] (0x0100): Marking port 389 of server
'ipa-lx-test-01.ipa.example.com' as 'not working' (Wed Aug 23 16:07:09
2017) [sssd[be[ipa.example.com]]] [fo_set_port_status] (0x0400): Marking
port 389 of duplicate server 'ipa-lx-test-01.ipa.example.com' as 'not
working' |
Thats true, ‘Keine Route zum Zielrechner’ means ‘no route to host’,
first instance is poweroff. Well looking forward in logfile
|(Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA' (Wed
Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [get_server_status]
(0x1000): Status of server 'ipa-lx-test-02.ipa.example.com' is 'name not
resolved' (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[get_port_status] (0x1000): Port status of port 389 for server
'ipa-lx-test-02.ipa.example.com' is 'neutral' (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [fo_resolve_service_activate_timeout]
(0x2000): Resolve timeout set to 6 seconds (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [resolve_srv_send] (0x0200): The status of
SRV lookup is resolved (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [get_server_status] (0x1000): Status of
server 'ipa-lx-test-02.ipa.example.com' is 'name not resolved' (Wed Aug
23 16:07:09 2017) [sssd[be[ipa.example.com]]] [resolv_is_address]
(0x4000): [ipa-lx-test-02.ipa.example.com] does not look like an IP
address (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[resolv_gethostbyname_step] (0x2000): Querying files (Wed Aug 23
16:07:09 2017) [sssd[be[ipa.example.com]]]
[resolv_gethostbyname_files_send] (0x0100): Trying to resolve A record
of 'ipa-lx-test-02.ipa.example.com' in files (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [set_server_common_status] (0x0100): Marking
server 'ipa-lx-test-02.ipa.example.com' as 'resolving name' (Wed Aug 23
16:07:09 2017) [sssd[be[ipa.example.com]]] [resolv_gethostbyname_step]
(0x2000): Querying files (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [resolv_gethostbyname_files_send] (0x0100):
Trying to resolve AAAA record of 'ipa-lx-test-02.ipa.example.com' in
files (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[resolv_gethostbyname_next] (0x0200): No more address families to retry
(Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[resolv_gethostbyname_step] (0x2000): Querying DNS (Wed Aug 23 16:07:09
2017) [sssd[be[ipa.example.com]]] [resolv_gethostbyname_dns_query]
(0x0100): Trying to resolve A record of 'ipa-lx-test-02.ipa.example.com'
in DNS (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[schedule_request_timeout] (0x2000): Scheduling a timeout of 6 seconds
(Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher (Wed
Aug 23 16:07:10 2017) [sssd[be[ipa.example.com]]] [check_fd_timeouts]
(0x4000): Checking for DNS timeouts (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [check_fd_timeouts] (0x4000): Checking for
DNS timeouts (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher
(Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[resolv_gethostbyname_dns_parse] (0x1000): Parsing an A reply (Wed Aug
23 16:07:11 2017) [sssd[be[ipa.example.com]]] [request_watch_destructor]
(0x0400): Deleting request watch (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [set_server_common_status] (0x0100): Marking
server 'ipa-lx-test-02.ipa.example.com' as 'name resolved' (Wed Aug 23
16:07:11 2017) [sssd[be[ipa.example.com]]] [be_resolve_server_process]
(0x0200): Found address for server ipa-lx-test-02.ipa.example.com:
[x.x.x.x] TTL 1200 (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [ipa_resolve_callback] (0x0400): Constructed
uri 'ldap://ipa-lx-test-02.ipa.example.com' (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [unique_filename_destructor] (0x2000):
Unlinking [/var/lib/sss/pubconf/.krb5info_dummy_U1QQrA] (Wed Aug 23
16:07:11 2017) [sssd[be[ipa.example.com]]] [unlink_dbg] (0x2000): File
already removed: [/var/lib/sss/pubconf/.krb5info_dummy_U1QQrA] (Wed Aug
23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sssd_async_socket_init_send] (0x4000): Using file descriptor [19] for
the connection. (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for
connecting (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
[ldap://ipa-lx-test-02.ipa.example.com:389/??base] with fd [19]. (Wed
Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sdap_get_rootdse_send] (0x4000): Getting rootdse (Wed Aug 23 16:07:11
2017) [sssd[be[ipa.example.com]]] [sdap_print_server] (0x2000):
Searching x.x.x.x:389 (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x0400):
calling ldap_search_ext with [(objectclass=*)][]. (Wed Aug 23 16:07:11
2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [*] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [altServer] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [namingContexts] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [supportedControl] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [supportedExtension] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [supportedFeatures] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [supportedLDAPVersion] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [supportedSASLMechanisms] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [domainControllerFunctionality] (Wed Aug 23 16:07:11
2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [defaultNamingContext] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [lastUSN] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [highestCommittedUSN] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x2000):
ldap_search_ext called, msgid = 1 (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_op_add] (0x2000): New operation 1
timeout 6 (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sdap_process_result] (0x2000): Trace: sh[0x558252c35750], connected[1],
ops[0x558252c36640], ldap[0x558252c130c0] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message
type: [LDAP_RES_SEARCH_ENTRY] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_entry] (0x1000): OriginalDN: [].
(Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sdap_parse_range] (0x2000): No sub-attributes for [objectClass] (Wed
Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range]
(0x2000): No sub-attributes for [vendorName] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [vendorVersion] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [dataversion] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [netscapemdsuffix] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [changeLog] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [firstchangenumber] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [lastchangenumber] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [ipatopologypluginversion] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [ipatopologyismanaged] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [ipaDomainLevel] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [namingContexts] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [supportedControl] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [supportedExtension] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [supportedFeatures] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [supportedLDAPVersion] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [supportedSASLMechanisms] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [defaultNamingContext] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [lastUSN] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace:
sh[0x558252c35750], connected[1], ops[0x558252c36640],
ldap[0x558252c130c0] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message
type: [LDAP_RES_SEARCH_RESULT] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_op_finished] (0x0400):
Search result: Success(0), no errmsg set (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_op_destructor] (0x2000): Operation 1
finished (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sdap_get_rootdse_done] (0x2000): Got rootdse (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_rootdse_done] (0x2000): Skipping
auto-detection of match rule (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [get_naming_context] (0x0200): Using value
from [defaultNamingContext] as naming context. (Wed Aug 23 16:07:11
2017) [sssd[be[ipa.example.com]]] [sdap_set_search_base] (0x0100):
Setting option [ldap_sudo_search_base] to [dc=ipa,dc=example,dc=com].
(Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[common_parse_search_base] (0x0100): Search base added:
[SUDO][dc=ipa,dc=example,dc=com][SUBTREE][] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_server_opts_from_rootdse]
(0x4000): USN value: 41151 (int: 41151) (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_kinit_send] (0x0400): Attempting kinit
(default, host/ipa-lx-test-debian9.ipa.example.com, ipa.example.com,
86400) (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sdap_kinit_next_kdc] (0x1000): Resolving next KDC for service IPA (Wed
Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA' (Wed
Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [get_server_status]
(0x1000): Status of server 'ipa-lx-test-02.ipa.example.com' is 'name
resolved' (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 6
seconds (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Wed
Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [get_server_status]
(0x1000): Status of server 'ipa-lx-test-02.ipa.example.com' is 'name
resolved' (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[be_resolve_server_process] (0x1000): Saving the first resolved server
(Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[be_resolve_server_process] (0x0200): Found address for server
ipa-lx-test-02.ipa.example.com: [x.x.x.x] TTL 1200 (Wed Aug 23 16:07:11
2017) [sssd[be[ipa.example.com]]] [sdap_kinit_kdc_resolved] (0x1000):
KDC resolved, attempting to get TGT... (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [create_tgt_req_send_buffer] (0x0400):
buffer size: 81 (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[child_handler_setup] (0x2000): Setting up signal handler up for pid
[2104] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[child_handler_setup] (0x2000): Signal handler set up for pid [2104]
(Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[set_tgt_child_timeout] (0x0400): Setting 6 seconds timeout for tgt
child (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sdap_process_result] (0x2000): Trace: sh[0x558252c35750], connected[1],
ops[(nil)], ldap[0x558252c130c0] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: end
of ldap_result list (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [write_pipe_handler] (0x0400): All data has
been sent! (Wed Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]]
[get_tgt_timeout_handler] (0x4000): timeout for sending SIGTERM to tgt
child [2104] reached. (Wed Aug 23 16:07:17 2017)
[sssd[be[ipa.example.com]]] [get_tgt_timeout_handler] (0x0400): Setting
2 seconds timeout for sending SIGKILL to tgt child (Wed Aug 23 16:07:17
2017) [sssd[be[ipa.example.com]]] [read_pipe_handler] (0x0400): EOF
received, client finished (Wed Aug 23 16:07:17 2017)
[sssd[be[ipa.example.com]]] [child_sig_handler] (0x1000): Waiting for
child [2104]. (Wed Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]]
[child_sig_handler] (0x0020): child [2104] failed with status [7]. (Wed
Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]] [child_callback]
(0x0020): LDAP child was terminated due to timeout (Wed Aug 23 16:07:17
2017) [sssd[be[ipa.example.com]]] [sdap_kinit_done] (0x0080):
Communication with KDC timed out, trying the next one (Wed Aug 23
16:07:17 2017) [sssd[be[ipa.example.com]]] [_be_fo_set_port_status]
(0x8000): Setting status: PORT_NOT_WORKING. Called from:
../src/providers/ldap/sdap_async_connection.c: sdap_kinit_done: 1207
(Wed Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]]
[fo_set_port_status] (0x0100): Marking port 389 of server
'ipa-lx-test-02.ipa.example.com' as 'not working' (Wed Aug 23 16:07:17
2017) [sssd[be[ipa.example.com]]] [fo_set_port_status] (0x0400): Marking
port 389 of duplicate server 'ipa-lx-test-02.ipa.example.com' as 'not
working' |
Ok, second server was found, but we ran in an timeout getting a TGT. If
i manually try to get a kerberos ticket it works, but with a long delay.
ipa-lx-test-debian9.ipa.example.com’s sssd.conf:
|[domain/ipa.example.com] cache_credentials = True
krb5_store_password_if_offline = True ipa_domain = ipa.example.com
id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname
= ipa-lx-test-debian9.ipa.example.com chpass_provider = ipa
ipa_dyndns_update = True ipa_server = _srv_,
ipa-lx-test-01.ipa.example.com ldap_tls_cacert = /etc/ipa/ca.crt
#subdomain_homedir = /home/%u fallback_homedir = /home/%u default_shell
= /bin/bash shell_fallback = /bin/bash debug_level = 10 [sssd] services
= nss, sudo, pam, ssh config_file_version = 2 domains = nbg.webtrekk.com
default_domain_suffix = example.com full_name_format = %1$s debug_level
= 10 [nss] debug_level = 10 [pam] [sudo] [autofs] [ssh] debug_level = 10
[pac] [ifp] |
So some need is help.
Michael
6 years, 2 months