Hello to the mailing list!
We are running FreeIPA to handle authentication, and having an issue. We
have a few tools that can not use the full IPA stack (PAM/SSSD/Kerberos),
but instead have to talk to the underlying LDAP server directly. The
problem we are facing is when user passwords expire, those users are still
granted access to these tools that only use LDAP. In researching this
issue, I ran into https://pagure.io/freeipa/issue/1539 - which seems to be
related. Is this still a known issue? Is there any way around it (like
being able to automatically disable any user who's password has been
expired for a certain period of time? This is within a PCI-compliant
infrastructure, so we have to make sure we cover all bases.
Thanks for any help you can give!
I'm trying to add replica but process fails:
Configuring certificate server (pki-tomcatd). Estimated
time: 3 minutes
[1/27]: creating certificate server db
[2/27]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 4 seconds elapsed
[3/27]: creating installation admin user
[error] ObjectclassViolation: unknown object class "cmsuser"
2018-04-23T12:45:43Z DEBUG [3/27]: creating installation
2018-04-23T12:45:43Z DEBUG Traceback (most recent call last):
line 504, in start_creation
line 494, in run_step
line 437, in setup_admin
line 1504, in add_entry
File "/usr/lib64/python2.7/contextlib.py", line 35, in
self.gen.throw(type, value, traceback)
line 990, in error_handler
ObjectclassViolation: unknown object class "cmsuser"
2018-04-23T12:45:43Z DEBUG [error] ObjectclassViolation:
unknown object class "cmsuser"
2018-04-23T12:45:43Z DEBUG File
line 172, in execute
Where to start troubleshooting? Is it existing masters and
or new replica candidate.?
many thanks, L.
I'd like to ask when, if at all, IPA's installer change
I install a client, afterwards no sss in nsswitch, I install
a replica on that client, still no sss. Is this normal,
many thanks, L.
I want to know how do I manage local UNIX users from
IPA server. We have 250 plus Red Hat servers and right now we are managing
all users locally ( manually changing passwords going on each box ). I have
installed a test IPA server and couple of client machines. However, I am
confused on how to I import /etc/passwd from local machines to IPA server.
I would appreciate if anyone can help me understand this. Thanks.
I wonder ... is a glitch, a problem... or just normal??
When I go to: /ipa
I get: ... Unable to verify your Kerberos credentials
but when I go directly to: /ipa/ui
then I'm presented with login page and I can login okey.
Should not/could not there be another rewriteRule(by default)?
many thanks, L.
We're currently making the switch from OpenLDAP to Freeipa. Clients are Ubuntu 16 (upgrading to 18 soon).
With FREEIPA, we can automount user home dirs (NFS) successfully with a single map, using auto.home
** However, on our current OpenLDAP system, there are groups of users, which effectively have different automount options, such as:
whereas the "X" is:
groupA: user1, user2, user3
groupB: user4, user5, user6
groupC, user7, user8, user9
We accomplish this by using nismapentry in OpenLAP.
Another way to look at it is, can a particular user in FREEIPA, be assigned a different NFS server, based on their userid?
Realizing that nismaps are not available in freeipa, is there a similar feature that we haven't found yet?
I have IPA server 4.5, conected to Windows AD the user replication is ok,
but i have strange problem with password sync some user synchronize
password without problem but other user account not password synchronize
User ok (can successfully log in)
User login: pruebas.sistemas
First name: Pruebas
Last name: Sistemas
Home directory: /home/pruebas.sistemas
Login shell: /bin/bash
Principal alias: pruebas.sistemas(a)EXAMPLE.COM
Email address: pruebas.sistemas(a)example.com
Account disabled: False
Kerberos keys available: True
Log ssh auth
Apr 17 16:45:03 odi-scan sshd: pam_sss(sshd:auth): authentication
success; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.191.3.30
Apr 17 16:45:05 odi-scan sshd: Accepted keyboard-interactive/pam for
pruebas.sistemas from 10.191.3.30 port 64603 ssh2
Apr 17 16:45:05 odi-scan sshd: pam_unix(sshd:session): session
opened for user pruebas.sistemas by (uid=0)
Apr 17 16:45:19 odi-scan sshd: pam_unix(sshd:session): session
closed for user pruebas.sistemas
User error (can't ssh log in)
User login: rodrigo.gutierrez
First name: Rodrigo Antonio
Last name: Gutiérrez Torres
Home directory: /home/rodrigo.gutierrez
Login shell: /bin/bash
Principal alias: rodrigo.gutierrez(a)EXAMPLE.COM
Email address: rodrigo.gutierrez(a)example.com
Telephone Number: +15013
Job Title: Ingeniero en Sistemas
Account disabled: False
Member of groups: admins
Member of Sudo rule: admin-log
Kerberos keys available: False
Error to server client:
Apr 17 17:06:54 odi-scan sshd: pam_sss(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.191.3.30
Apr 17 17:06:54 odi-scan sshd: pam_sss(sshd:auth): received for user
rodrigo.gutierrez: 17 (Failure setting user credentials)
Two ssh connection is against the same server .
Miguel Coa M.
When attempting to migrate an existing OpenLDAP server to FreeIPA (version 4.5.0 on Centos 7), I am getting the following error - unknown object class "ededuperson"
If I look at the LDAP I can see
Description: Additional attributes for AuthLDAP
Inherits from: eduPerson
I have added the eduperson ldif to my FreeIPA server,
cp /usr/share/dirsrv/schema/60eduperson.ldif /etc/dirsrv/slapd-XXXXXschema/
but I am unsure how to add the object class ededuperson.
New to this - any help greatly appreciated
We've failed to deploy a replica in a remote DC, initially the CA Master
(ipa_server1) was in a location that this remote DC could not reach so I
moved the CA to a contactable IPA server in another location (ipa_server2.)
I still receive CA_REJECTED however and I suspect we may have hit
https://bugzilla.redhat.com/show_bug.cgi?id=1498523 as the previous week, a
colleague of mine rebuilt all of our existing IPA deployment using the
Damascus Group export/import scripts (his task was to migrate from SUSE
Linux to Oracle Linux and upgrade IPA to 4.5.0) If we have hit this issue,
I do not feel comfortable carrying out the steps Flo mentions in #c24.
'ipa-getcert list' certainly shows the remote ipa install trying to connect
to itself for certificates.
After moving the CA Master to ipa_server2 (contactable) we get the same
result as before for ipa-getcert list, but also notice an INFO message when
running the ipa-replica-install command in the remote DC.
INFO Waiting up to 300 seconds to see our keys appear on host: ipa_server1
(the un-contactable one)
I thought connections between IPA servers were only required along
replication agreement paths, this INFO message suggests we might need
connectivity between all nodes - perhaps it's just during the install
process - I'm unsure.
So we've opted to connect the sssd clients in the remote DC to IPA servers
in our 2 main DCs, which goes against best practises of having at least 2
IPA servers per DC. I will connect the clients to an IPA server in DC1 and
another IPA server in DC2 as each DC has a VPN tunnel connecting to the
remote site. The rhel7 documentation does not explain why best practises
requires at least 2 IPAs per DC - any thoughts on this setup and best
Thanks for your time.
I have passsync configured and working just fine, but with one minor
the passsync.log file is filled with "computer account" password changes.
Example: (first one is a user passwd change, second is computer account.)
04/16/18 09:02:02: Received passhook event. Attempting sync
04/16/18 09:02:02: 1 new entries loaded from data file
04/16/18 09:02:02: Cleared contents of data file
04/16/18 09:02:02: Password list has 1 entries
04/16/18 09:02:02: Attempting to sync password for userA
04/16/18 09:02:02: Searching for (ntuserdomainid=userA)
04/16/18 09:02:02: Password modified for remote entry:
04/16/18 09:02:02: Removing password change from list
04/16/18 09:02:02: Password list is empty. Waiting for passhook event
04/16/18 09:10:50: Received passhook event. Attempting sync
04/16/18 09:10:50: 1 new entries loaded from data file
04/16/18 09:10:50: Cleared contents of data file
04/16/18 09:10:50: Password list has 1 entries
04/16/18 09:10:50: Attempting to sync password for computerA$
04/16/18 09:10:50: Searching for (ntuserdomainid=computerA$)
04/16/18 09:10:50: There are no entries that match: computerA$
04/16/18 09:10:50: Deferring password change for computerA$
04/16/18 09:10:50: Backing off for 2000ms
04/16/18 09:10:52: Backoff time expired. Attempting sync
04/16/18 09:10:52: Password list has 1 entries
04/16/18 09:10:52: Attempting to sync password for computerA$
04/16/18 09:10:52: Searching for (ntuserdomainid=computerA$)
04/16/18 09:10:52: There are no entries that match: computerA$
04/16/18 09:10:52: Deferring password change for computerA$
04/16/18 09:10:52: Backing off for 4000ms
...and so on.
Firstly: wondering if that's "normal" to see?
Second: Is it possible to configure passync to only look for user password
changes and ignore computer accounts? (or at least not log them). I coulda
sworn I stumbled across something in the past showing how to configure it
that way, but cannot find anything today.