external ocsp ?
by veer Schlansky
My company's PIV/AD credintial is user(a)example.com. We set up our IPA
credintial as user(a)linux.example.com
example.com and linux.example.com are completedly seperated domain/realms,
no trust or interaction whatsoever.
I took the user and CA certs on the PIV card and put them into ipa. I was
able to authenticate to ipa webui with my PIV card.
My question is does ipa do online certificate status protocol check for the
user(a)example.com cert? Any way to verify that?
Thanks.
3 years, 5 months
de/selecting AD's users
by lejeczek
hi guys
I wonder, and hope you guys could tell if it's possible in IPA, when
there is one-way trust established between AD & IPA, to allow only
certain account to login & access IPA's resources?
An ideal scenario I'm looking for is where all users from AD are
initially disallowed to login & access IPA domain, and then admin can
allow such user on per user or group basis.
Is something like that "built-in" IPA's feature?
many thanks, L.
3 years, 5 months
Web UI login/certificate issues, IPA 4.5.4
by dbischof@hrz.uni-kassel.de
Hi,
my IPA system consists of 2 masters with their own self-signed CAs, one of
them being the certificate renewal master (ipa1). The system has been
running for years and has been migrated from an IPA 3 system.
Since a while, the Web UI logins on ipa1 don't work anymore ("Login failed
due to an unknown reason.").
Web UI logins on the other server (ipa2) work and everything else is
working fine, too, ipactl status reports all services running.
On login attempt:
--- httpd log
[...]
[:error] [pid 15551] [remote 141.51.X.X:0] mod_wsgi (pid=15551): Exception occurred processing WSGI script '/usr/share/ipa/wsgi.py'.
[...]
[:error] [pid 15551] [remote 141.51.X.X:0] CalledProcessError: Command '/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_15551 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem' returned non-zero exit status 1
---
--- krb5kdc.log
[...]
Dec 20 16:06:54 ipa1.example.com krb5kdc[15517](info): AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 141.51.X.Y: NEEDED_PREAUTH: WELLKNOWN/ANONYMOUS(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Additional pre-authentication required
Dec 20 16:06:54 ipa1.example.com krb5kdc[15517](info): closing down fd 11
Dec 20 16:06:54 ipa1.example.com krb5kdc[15518](info): AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 141.51.X.Y: KDC_RETURN_PADATA: WELLKNOWN/ANONYMOUS(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Failed to verify own certificate (depth 0): certificate has expired
Dec 20 16:06:54 ipa1.example.com krb5kdc[15518](info): closing down fd 11
---
--- ipa-checkcerts.py
IPA version 4.5.4-10.el7.centos.3
Check CA status
Check tracking
Check NSS trust
Check dates
Checking certificates in CS.cfg
Comparing certificates to requests in LDAP
Checking RA certificate
Checking authorities
Checking host keytab
Validating certificates
Checking renewal master
End-to-end cert API test
Checking permissions and ownership
Failures:
Unable to find request for serial 268304391
Unable to find request for serial 268304394
Unable to find request for serial 268304393
Unable to find request for serial 268304392
Subject O=EXAMPLE.COM,CN=ipa2.example.com and template subject CN=ipa1.example.com,O=EXAMPLE.COM do not match for serial 57
---
--- ipa pkinit-status --all
-----------------
2 servers matched
-----------------
Server name: ipa2.example.com
PKINIT status: enabled
Server name: ipa1.example.com
PKINIT status: enabled
----------------------------
Number of entries returned 2
----------------------------
To my understanding, proper certificate exchange between my two servers
ceased working at some point. How do i track this down and fix it?
Mit freundlichen Gruessen/With best regards,
--Daniel.
3 years, 5 months
Re: Testing requested - certificate checking tool
by SOLER SANGUESA Miguel
Hello,
I have run the tool on an environment where I've installed my own certificate for HTTPS (following this tutorial: https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP), and it complains when find the root certificate of my certificate:
# python2 ipa-checkcerts.py
ipa: INFO: IPA version 4.6.4-10.el7
IPA version 4.6.4-10.el7
ipa: INFO: Check CA status
Check CA status
ipa: INFO: Check tracking
Check tracking
ipa: INFO: Check NSS trust
Check NSS trust
Traceback (most recent call last):
File "ipa-checkcerts.py", line 931, in <module>
sys.exit(c.run())
File "ipa-checkcerts.py", line 190, in run
self.check_trust()
File "ipa-checkcerts.py", line 439, in check_trust
expected = expected_trust[nickname]
KeyError: 'ICC-root'
Is this normal?
Because I have tried to add a RHEL 6 client and I get the error:
" Successfully retrieved CA cert
Subject: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
Valid From: Mon Jan 30 10:52:18 2017 UTC
Valid Until: Fri Jan 30 10:52:18 2037 UTC
Joining realm failed: libcurl failed to execute the HTTP POST transaction. Peer certificate cannot be authenticated with known CA certificates"
Thanks & Regards.
3 years, 5 months
PAM OTP login requirements
by Brian Topping
Hi all, I hope this is the best place to ask this, please let me know if not.
I am setting up a PAM client (libreswan, using the `pluto` service). When I log in with a non-OTP account, everything works fine, but not with an OTP account. I have tested the OTP account by logging into the node with SSH and the OTP user and it works fine, so I know both that the token works and that the client configuration are both correct. I’ve tried a few different PAM stacks to see if I could get around this, including the sshd stack to no avail. In all cases, the FreeIPA server logs state `Additional pre-authentication required` and then `Preauthentication failed`.
Preauthentication makes sense, I just don’t understand why sshd works fine with both password factors concatenated in the first factor and libreswan (and xl2tpd when I was testing it) both fail with preauth issues. What am I missing? Are there good docs on this somewhere? [1] was the best I could come up with and it seems to be out-of-date (pam_sss takes different parameters for some of the same functions in the final form).
Cheers! Brian
[1] https://docs.pagure.org/SSSD.sssd/design_pages/pam_conversation_for_otp.html
3 years, 5 months
FreeIPA not working (Segfault in Kerberos) after upgrading to Fedora 29
by Patrick Dung
Hello,
After upgrading to Fedora 29, Kerberos on the primary Free IPA is not working. Another FreeIPA replica failed to start. It is because Kerberos (GSSAPI) is not working and ns-slapd cannot start. Replication agreement cannot be established via Kerberos (GSSAPI)
I got this messages in for the kernel log.
Dec 27 02:00:05 server1 kernel: [ 2551.272984] krb5_child[25058]: segfault at 6e ip 00007f58ae29464e sp 00007fffb5047bf0 error 4 in libkrb5.so.3.3[7f58ae26b000+71000]
Dec 27 02:00:05 server1 kernel: [ 2551.273449] Code: fc bf 28 00 00 00 55 53 48 83 ec 18 64 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 e8 2b 9b fd ff 48 85 c0 0f 84 02 01 00 00 <f3> 41 0f 6f 07 f3 41 0f 6f 4f 10 48 89 c3 49 63 7f 20 0f 11 00 0f
Dec 27 02:00:05 server1 kernel: [ 2551.272984] krb5_child[25058]: segfault at 6e ip 00007f58ae29464e sp 00007fffb5047bf0 error 4 in libkrb5.so.3.3[7f58ae26b000+71000]
Dec 27 02:00:05 server1 kernel: [ 2551.273449] Code: fc bf 28 00 00 00 55 53 48 83 ec 18 64 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 e8 2b 9b fd ff 48 85 c0 0f 84 02 01 00 00 <f3> 41 0f 6f 07 f3 41 0f 6f 4f 10 48 89 c3 49 63 7f 20 0f 11 00 0f
Any ideas? FYI I had already opened a ticket in bugzilla: 1662175 – Segfault in freeipa/krb5_child after upgrading to Fedora 29
|
|
| |
1662175 – Segfault in freeipa/krb5_child after upgrading to Fedora 29
|
|
|
Thanks,Patrick
3 years, 6 months
Service named-pkcs11.service on master fails: Process 3946 (named-pkcs11) of user 25 dumped core
by 74cmonty
Hi,
starting service `named-pkcs11.service` fails with a core dump:
```
Dez 29 17:32:25 ipa-master.example.com systemd-coredump[2901]: Process 2895 (named-pkcs11) of user 25 dumped core.
Stack trace of thread 2897:
#0 0x00007f2b386c753f raise (libc.so.6)
#1 0x00007f2b386b1895 abort (libc.so.6)
#2 0x00007f2b386b1769 __assert_fail_base.cold.0 (libc.so.6)
#3 0x00007f2b386bf9f6 __assert_fail (libc.so.6)
#4 0x00007f2b38fb8c95 n/a (libkrb5.so.3)
#5 0x00007f2b38fb96ef n/a (libkrb5.so.3)
#6 0x00007f2b38fc2d0c n/a (libkrb5.so.3)
#7 0x00007f2b38fbc8b3 n/a (libkrb5.so.3)
#8 0x00007f2b38fbb9dd krb5_cc_select (libkrb5.so.3)
#9 0x00007f2b3909b959 n/a (libgssapi_krb5.so.2)
#10 0x00007f2b390a4a82 n/a (libgssapi_krb5.so.2)
#11 0x00007f2b390a5b06 n/a (libgssapi_krb5.so.2)
#12 0x00007f2b3908f0bb gss_init_sec_context (libgssapi_krb5.so.2)
#13 0x00007f2b34824667 gssapi_client_mech_step (libgssapiv2.so)
#14 0x00007f2b34907471 sasl_client_step (libsasl2.so.3)
#15 0x00007f2b349075fa sasl_client_start (libsasl2.so.3)
#16 0x00007f2b3494624b ldap_int_sasl_bind (libldap-2.4.so.2)
#17 0x00007f2b349498ec ldap_sasl_interactive_bind (libldap-2.4.so.2)
#18 0x00007f2b34949b0a ldap_sasl_interactive_bind_s (libldap-2.4.so.2)
#19 0x00007f2b34992c6f ldap_connect (ldap.so)
#20 0x00007f2b3499fa90 new_ldap_instance (ldap.so)
#21 0x00007f2b34990292 dyndb_init (ldap.so)
#22 0x00007f2b3943f75a dns_dyndb_load (libdns-pkcs11.so.1102)
#23 0x00005612e6a46718 n/a (named-pkcs11)
#24 0x00005612e6a53ed3 n/a (named-pkcs11)
#25 0x00005612e6a54f47 n/a (named-pkcs11)
#26 0x00007f2b3938d899 n/a (libisc-pkcs11.so.169)
#27 0x00007f2b38bd458e start_thread (libpthread.so.0)
#28 0x00007f2b3878c6a3 __clone (libc.so.6)
Stack trace of thread 2898:
#0 0x00007f2b38bdaa8a pthread_cond_timedwait@(a)GLIBC_2.3.2 (libpthread.so.0)
#1 0x00007f2b393ad2b0 isc_condition_waituntil (libisc-pkcs11.so.169)
#2 0x00007f2b39394683 n/a (libisc-pkcs11.so.169)
#3 0x00007f2b38bd458e start_thread (libpthread.so.0)
#4 0x00007f2b3878c6a3 __clone (libc.so.6)
Stack trace of thread 2899:
#0 0x00007f2b3878c9d7 epoll_wait (libc.so.6)
#1 0x00007f2b393a501c n/a (libisc-pkcs11.so.169)
#2 0x00007f2b38bd458e start_thread (libpthread.so.0)
#3 0x00007f2b3878c6a3 __clone (libc.so.6)
Stack trace of thread 2896:
#0 0x00007f2b38bda73c pthread_cond_wait@(a)GLIBC_2.3.2 (libpthread.so.0)
#1 0x00007f2b3938d695 n/a (libisc-pkcs11.so.169)
#2 0x00007f2b38bd458e start_thread (libpthread.so.0)
#3 0x00007f2b3878c6a3 __clone (libc.so.6)
Stack trace of thread 2895:
#0 0x00007f2b386c78ee __sigsuspend (libc.so.6)
#1 0x00007f2b3939713e isc__app_ctxrun (libisc-pkcs11.so.169)
#2 0x00007f2b39397d73 isc_app_run (libisc-pkcs11.so.169)
#3 0x00005612e6a07d05 n/a (named-pkcs11)
#4 0x00007f2b386b3413 __libc_start_main (libc.so.6)
#5 0x00005612e6a0865e n/a (named-pkcs11)
Dez 29 17:32:25 ipa-master.example.com audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-coredump@10-2900-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
```
Full log is available here: http://freetexthost.com/nx1e4xhmyi
Assuming this issue is related to file /usr/lib64/bind/ldap.so I tried to scp from replica server.
However this fails with this weird error:
```[root@ipa-master ~]# ssh -p 22202 ipa-replica.example.com
ssh_exchange_identification: Connection closed by remote host
[root@ipa-master ~]# scp -P 22201 ipa-replica.example.com:/usr/lib64/bind/ldap.so /home/
Password:
\033[0m\033[1;34m /:-------------:\ \033[0m\033[1;34m root\033[0m\033[1m(a)\033[0m\033[0m\033[1;34mipa-replica.example.com\033[0m
````
3 years, 6 months