ID view is not overriding user attributes
by Supratik Goswami
Hello everyone,
I have a trust setup between AD and IPA, I have created a user in the
"Default Trust View" and
updated the ssh public keys for that user.
When I am trying to login to any Linux system using the ad user it is not
able to find the keys.
Here is the sshd debug log.
Aug 9 03:04:01 host01 sshd[20102]: debug3: Running AuthorizedKeysCommand:
"/usr/bin/sss_ssh_authorizedkeys supratik.goswami(a)ad.corp.example.com" as
"nobody"
Aug 9 03:04:01 host01 sshd[20102]: debug1: restore_uid: 0/0
Aug 9 03:04:01 host01 sshd[20102]: debug1: temporarily_use_uid: 99/99
(e=0/0)
Aug 9 03:04:01 host01 sshd[20106]: debug3: sshd_selinux_setup_variables:
setting execution context
Aug 9 03:04:01 host01 sshd[20102]: debug2: key not found
Aug 9 03:04:01 host01 sshd[20102]: debug1: restore_uid: 0/0
My sshd_config file has the following entries
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
AuthorizedKeysCommandUser nobody
What could be the issue?
Thanks
--
Warm Regards
Supratik
6 years, 7 months
Issue with FreeIPA and Kerberized NFSv4 Client on Ubuntu 16.04LTS
by Robert Sturrock
I’m not sure if my problem is with IPA or Kerberized NFSv4 but I’m hoping the list may be able to help.
I’m trying to get a Kerberized NFSv4 client going on an Ubuntu 16.04LTS system that’s enrolled to IPA with an AD trust. I can mount the filesystem successfully with:
mount -o sec=krb5 -t nfs4 nfsserver.ipa.localdomain:/export/home /mnt
.. but when I try to access from my normal user account (uid: 1388813135, resolved from IPA via an AD trust) it fails:
$ ls /mnt
ls: cannot access '/mnt': Permission denied
I do have a TGT in LOCALDOMAIN, stored in a kernel keyring:
$ klist
Ticket cache: KEYRING:persistent:1388813135:krb_ccache_jU3s6mw
Default principal: rns@LOCALDOMAIN
Valid starting Expires Service principal
10/08/17 15:34:30 11/08/17 01:34:30 krbtgt/LOCALDOMAIN@LOCALDOMAIN
renew until 11/08/17 15:34:29
When I run ‘rpc.gssd -fvvv’ I see:
handling gssd upcall (/run/rpc_pipefs/nfs/clnt34)
handle_gssd_upcall: 'mech=krb5 uid=1388813135 enctypes=18,17,16,23,3,1,2 '
handling krb5 upcall (/run/rpc_pipefs/nfs/clnt34)
process_krb5_upcall: service is '<null>'
ERROR: GSS-API: error in gss_acquire_cred(): GSS_S_FAILURE (Unspecified GSS failure. Minor code may provide more information) - Can't find client principal rns@localdomain in cache collection
getting credentials for client with uid 1388813135 for server nfsserver.ipa.localdomain
CC '/tmp/krb5ccmachine_IPA.LOCALDOMAIN' being considered, with preferred realm 'IPA.LOCALDOMAIN'
CC '/tmp/krb5ccmachine_IPA.LOCALDOMAIN' owned by 0, not 1388813135
getting credentials for client with uid 1388813135 for server nfsserver.ipa.localdomain
WARNING: Failed to create krb5 context for user with uid 1388813135 for server nfsserver.ipa.localdomain
doing error downcall
I’m a little unclear as to why it references client principal 'rns@localdomain’, as I’d have expected my principal to be ‘rns@LOCALDOMAIN’.
However, an ‘strace’ on rpc.gssd does seem to indicate that it’s finding the credentials in the keyring:
21915 geteuid() = 0
21915 open("/etc/krb5/user/0/client.keytab", O_RDONLY) = -1 ENOENT (No such file or directory)
21915 write(17, "[21915] 1502322917.102061: Retrieving rns@localdomain from FILE:/etc/krb5/user/0/client.keytab (vno 0, enctype 0) with result"..., 190) = 190
21915 getuid() = 0
21915 keyctl(KEYCTL_GET_PERSISTENT, 0, KEY_SPEC_PROCESS_KEYRING) = 310945083
21915 keyctl(KEYCTL_SEARCH, 310945083, "keyring", "_krb", KEY_SPEC_PROCESS_KEYRING) = 19783009
21915 keyctl(KEYCTL_SEARCH, 19783009, "user", "krb_ccache:primary", 0) = 1046694120
21915 keyctl(KEYCTL_READ, 1046694120, NULL, 0) = 9
21915 keyctl(KEYCTL_READ, 1046694120, "", 9) = 9
21915 keyctl(KEYCTL_READ, 19783009, NULL, 0) = 4
21915 keyctl(KEYCTL_READ, 19783009, "\350Hc>", 4) = 4
21915 keyctl(KEYCTL_SEARCH, 19783009, "keyring", "0", 0) = -1 ENOKEY (Required key not available)
21915 keyctl(KEYCTL_DESCRIBE, 1046694120, NULL, 0) = 37
21915 keyctl(KEYCTL_DESCRIBE, 1046694120, "user;0;0;3f010000;krb_ccache:primary", 37) = 37
Later on, I see it looking in /run/user/1388813135, but immediately warns that it can’t create a krb5 context:
21915 write(2, "getting credentials for client with uid 1388813135 for server nfsserver.ipa.localdomain\n", 90) = 90
21915 open("/run/user/1388813135", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 17
21915 fstat(17, {st_mode=S_IFDIR|0700, st_size=280, ...}) = 0
21915 getdents(17, /* 14 entries */, 32768) = 472
21915 getdents(17, /* 0 entries */, 32768) = 0
21915 close(17) = 0
21915 write(2, "WARNING: Failed to create krb5 context for user with uid 1388813135 for server nfsserver.ipa.localdomain\n", 107) = 107
Any idea as to what the problem might be here, or where I should be focussing my debugging efforts?
(This is working from a RHEL7 client, but the configuration seems a little different there, as it’s using gssproxy.)
Regards,
Robert.
6 years, 7 months
Show AD groups members from command line
by Steve Weeks
I can use 'id ad_user@ad_domain' command to see what groups an ad_user is a
member of.
Is there a way from the Linux command line to see who are the member of
some_ad_group@ad_domain are?
Thanks,
Steve
6 years, 7 months
mod_ldap apache
by Per Qvindesland
Hi All
Does anyone have any working mod_ldap configuration for Centos 7 with apache 2.4.6 with iPad to share?
Regards
Per
6 years, 7 months
FIPA OTP 2FA
by saidireddy ranabothu
Hello all,
I have enabled password+OTP authentication for a user and able to sync
tokens and SSH.
While ssh to server using FIPA credentials it's asking authentication in
two steps as First Factor and Second Factor .
But i just want to give it in a single line password ,Can any one suggest
how to do it as a single line password?
--
Thanks,
SaidiReddy
6 years, 7 months
HBAC vs Sudo
by Steve Weeks
We are running FreeIPA 4.4. Even though sudo is listed as one of the
services in the HBAC rule, it seems like only the Sudo rules are what
really controls sudo. Sudo ignores what is in the HBAC rules.
Is this expected behavior? It doesn't really which way it really works, we
are more concerned that we might be confused and screwing something up.
Thanks,
Steve
6 years, 7 months
Creating certificate for master domain
by Rafał Wądołowski
Hi,
I have freeipa 4.4 cluster with CN intra.example.com.
We developed intranet on this same domain, but I can't create a valid
certificate for it.
I can't create service, because hostname is required. Is it other way to
sign the CSR?
What is the good practice for creating https certificates?
--
Best regards,
Rafał Wądołowski
6 years, 7 months
reverse zone after install?
by Kat
Hi All,
If you setup DNS but did not enable the reverse zone during the initial
install, is there a way to add/enable it after the fact? I can script
adding in all the PTR records, but wanted to find out how to
create/enable the reverse zone once you have already installed.
Thanks
K
6 years, 7 months
howto replace an externally signed CA
by Harald Dunkel
Hi folks,
Problem: I have setup freeipa using a bad external CA.
Long story:
I have setup my freeipa servers using
ipa-server-install -n example.com -r EXAMPLE.COM --no-ntp --external-ca --subject="O=example AG,C=DE" --setup-dns --forwarder=...
on ipa1.example.com. It created a csr, it was signed by the
external PKI, and then I re-run ipa-server-install
ipa-server-install -n example.com -r EXAMPLE.COM --subject="O=example AG,C=DE" --external-cert-file=/root/ipa_ipa1.crt --external-cert-file=/root/root-ca.crt --setup-dns --forwarder=...
Problem: The root-ca.crt is bad. It doesn't follow RFC5280. It
is not accepted by libressl, e.g. on OpenBSD. I have to replace
both ipa_ipa1.crt and root-ca.crt.
Of course I have found ipa-cacert-manage(1) and https://www.freeipa.org/\
page/V4/CA_certificate_renewal, but they don't really tell how to
proceed in this case. I don't want to renew, but to install a
new certificate chain.
The old csr file is still available.
I have 5 servers (Centos 7.3, freeipa 4.4.0) and >100 clients.
3 servers are CS replicas. The servers are not yet affected by
the bad root certificate, but it might be just a matter of time
til openssl follows RFC5280 more closely.
Every helpful comment is highly appreciated.
Harri
6 years, 7 months
Using AWS ELB with 2 FreeIPA servers
by ridha.zorgui@infor.com
I set up a FreeIPA master and replica behind an elastic load balancer in AWS cloud. FreeIPA Clients will be contacting the replica and the master sever through the load balancer so the dns name used when configurting the clients is the ELB CNAME. The problem is when retreiving ldap data and during the authentication, the SSL handshake fails as the certificate sent back from the master or replica has a hostname different than the one used in the sssd ( the ELB CNAME). so the connection is terminated. There is a workaround which is the use reqcert=allow but this bring a security issue with a MITM attack. another solution i found is the use SAN. I was able to add the ELB DNS as a SAN in freeipa servers certificate. i made sure it is there by downloading the certificate and checking that the elb san exist but when testing it the same problem remain. Please help.
6 years, 7 months