IPA and AD basedn
by Mirko Spezie
Hi,
I've configured IPA with trust to our AD. Everything seems ok except for one thing: if one AD user is not present in "cn=Users,dc=example,dc=org" but exists in "ou=Group,dc=example,dc=org" , I can login only on IPA server. The IPA clients accepts login only from the AD users present in "cn=Users,dc=example,dc=org".
This is the /var/log/secure output from the IPA client when I'm trying to connect with my user that is present in "ou=my organization unit,dc=example,dc=org" or "ou=Domain Users,dc=example,dc=org":
Aug 9 09:59:52 freeipaclient sshd[3334]: pam_unix(sshd:auth): check pass; user unknown
Aug 9 09:59:52 freeipaclient sshd[3334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=finke.example.org
Aug 9 09:59:54 freeipaclient sshd[3332]: error: PAM: User not known to the underlying authentication module for illegal user mspezie(a)example.org from finke.example.org
Aug 9 09:59:54 freeipaclient sshd[3332]: Failed keyboard-interactive/pam for invalid user mspezie(a)example.org from 192.168.*.* port 64721 ssh2
Aug 9 09:59:54 freeipaclient sshd[3332]: Postponed keyboard-interactive for invalid user mspezie(a)example.org from 192.168.*.* port 64721 ssh2 [preauth]
If I try to connect with a user present in "cn=Users,dc=example,dc=org" this is the /var/log/secure output:
Aug 9 10:18:08 freeipaclient sshd[3358]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=finke.example.org user=freeipa(a)example.org
Aug 9 10:18:09 freeipaclient sshd[3354]: Accepted keyboard-interactive/pam for freeipa(a)example.org from 192.168.*.* port 64945 ssh2
Aug 9 10:18:09 freeipaclient sshd[3354]: pam_unix(sshd:session): session opened for user freeipa(a)example.org by (uid=0)
It seems that IPA client can only search in "cn=Users,dc=example,dc=org" . How could I change it or permit to look in the groups (we have 3 groups with all the users stored there and no one in cn=Users except for admins or testing)?
5 years, 7 months
ERR: ID value too large
by Роман Гинович
Hello, when i run
[root@freeipa ~]# ipa-adtrust-install --add-sids
all done,
Configuring CIFS
[1/23]: validate server hostname
...
[22/23]: adding SIDs to existing users and groups
This step may take considerable amount of time, please wait..
[23/23]: restarting smbd
Done configuring CIFS.
but in dirserv logs:
[02/Aug/2018:10:37:10] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 194]: Sidgen task starts ...
[02/Aug/2018:10:37:10] - ERR - find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 483]: ID value too large.
[02/Aug/2018:10:37:10] - ERR - do_work - [file ipa_sidgen_task.c, line 154]: Cannot add SID to existing entry.
[02/Aug/2018:10:37:10] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task finished [19].
my ID range
[root@freeipa ~]# ipa idrange-find
---------------
1 range matched
---------------
Range name: DOMAIN_id_range
First Posix ID of the range: 10000
Number of IDs in the range: 10000
First RID of the corresponding RID range: 1000
First RID of the secondary RID range: 100000000
Range type: local domain range
------------------------------
Количество вернутых значений 1
------------------------------
How to fix it?
When i create new user ipaNTHash was created and all work fine. But already created users don't have ipaNTHash.
5 years, 7 months
SSH SSO on Multi-Homed Hosts
by Theese, David C
Hello,
I am using CentOS 7.3 and FreeIPA 4.4.
I have one FreeIPA server and several FreeIPA clients. SSH SSO has been working fine (via Kerberos). Call the network they reside on 192.168.1.0/24 (the "primary" network).
I recently added a second NIC to each of the clients. Thus, all clients share a presence on a secondary, private network. The server does not have a presence on this network. Call this network 192.168.2.0/24 (the "secondary" network).
Since each client has two IP addresses, it has two hostnames configured in DNS. Call these the "primary" (corresponding to the client's address in 192.168.1.0/24) and "secondary (corresponding to the client's address in 192.168.2.0/24) hostnames. Of course, reverse (PTR) records are also setup to map the IP addresses back to the corresponding hostnames.
Hostnames and IP addresses are as follows:
server.example.com: 192.168.1.1
client-1.example.com (primary): 192.168.1.2
client-1-eth1.example.com (secondary): 192.168.2.2
client-2.example.com (primary): 192.168.1.3
client-2-eth1.example.com (secondary): 192.168.2.3
I configured the server as follows:
ipa-server-install \
-r EXAMPLE.COM \
-n example.com \
--mkhomedir \
--hostname=server.example.com \
--ip-address=192.168.1.1 \
--ssh-trust-dns \
--setup-dns \
--auto-forwarders \
--forward-policy=only \
--auto-reverse \
--dirsrv-cert-file=<path to server SSL certificate> \
--http-cert-file=<path to server SSL certificate> \
--no-dnssec-validation
--auto-reverse did not appear to work, so I manually added the DNS PTR record 192.168.1.1 --> server.example.com
I configured the clients as follows:
ipa-client-install \
--force-ntpd \
-p admin \
-W \
--mkhomedir \
--no-nisdomain \
--ssh-trust-dns
Again, I had to manually add DNS PTR records:
192.168.1.2 --> client-1.example.com
192.168.1.3 --> client-2.example.com
At this point I can SSH between the server and clients just fine without being prompted to accept an SSH host key and without being prompted for my password. SSH SSO via Kerberos is working fine on the primary network.
Now I need to get SSH SSO working on the secondary network. To accomplish this, I did the following:
On client-1:
ipa-join -h client-1-eth1.example.com
On client-2:
ipa-join -h client-2-eth1.example.com
This caused forward DNS records (i.e. A records) to be created, but once again, reverse records were not created, so I manually added the following PTR records to DNS:
192.168.2.2 --> client-1-eth1.example.com
192.168.2.3 --> client-2-eth1.example.com
At this point, I am now prompted to accept a host key, so SSO is not yet working on the secondary network. If I go ahead and accept the host key, I am *not*, however, prompted for my password.
So, the user authentication part of SSO is working on the secondary network, but the host authentication part of SSO is *not* working on the secondary network.
I have observed the following in the FreeIPA web interface:
1. Under Identity --> Hosts, client-1-eth1.example.com and client-2-eth1.example.com exist.
2. client-1-eth1.example.com and client-2-eth1.example.com do not have any SSH host keys associated with them.
3. Under Network Services --> DNS --> DNS Zones --> example.com, client-1-eth1.example.com and client-2-eth1.example.com have no SSHFP records.
4. If I manually add SSH host keys under Identity --> Hosts for the clients but do *not* manually add corresponding SSHFP records to DNS, I *can* SSH to a client's secondary interface without being prompted to accept an SSH host key (i.e. SSO *does* work on the secondary interface)
5. If I manually add SSHFP records to DNS for the clients but do *not* add the corresponding SSH host keys under Identity --> Hosts, I *cannot* SSH to a client's secondary interface without being prompted to accept an SSH host key (i.e. SSO *does not* work on the secondary interface)
What must I do to get the client's secondary hostnames properly enrolled in FreeIPA so that SSH SSO works when using those secondary hostnames?
Thanks,
Dave
5 years, 7 months
ipa require mvn?
by michael_ly@sina.cn
Dear,
I tried to install ipa using "yum install -y ipa-server" in CentOS 7.2.
Since the environement cann not connect to network, i prepared an local yum repository using iso file.
Then i encountered dependency issue as below,
Error: Package: resteasy-base-jaxrs-3.0.6-4.el7.norach (iso) Requires: mvn(org.jboss.spec.javax.annotation:jboss-annotatioins-api_1.1_spec)
Does it mean I should install maven?
Which packages needed for it?
Anyone have idea?
5 years, 7 months
Kerberized SSH SSO
by Ryan Slominski
Hi IPA Users,
I'm attempting to setup Single Sign On (SSO) with SSH in an IPA domain. I'd like to allow users who already have a Kerberos ticket to be allowed to SSH around the network without being prompted for a password. I have the following configuration:
/etc/ssh/sshd_config has:
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
/etc/ssh/ssh_config has:
Host *
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
Here is the output I'm seeing:
[testuser@testclient1 ssh]$ klist -f
Ticket cache: KEYRING:persistent:1234:krb_ccache_skEebtp
Default principal: testuser(a)EXAMPLE.COM
Valid starting Expires Service principal
08/06/2018 11:02:26 08/07/2018 11:01:22 host/testclient2.example.com(a)EXAMPLE.COM
Flags: FAT
08/06/2018 11:01:55 08/07/2018 11:01:22 host/testclient2(a)EXAMPLE.COM
Flags: FAT
08/06/2018 11:01:55 08/07/2018 11:01:22 host/testclient2@
Flags: FAT
08/06/2018 11:01:22 08/07/2018 11:01:22 krbtgt/example.com(a)EXAMPLE.COM
Flags: FIA
[testuser@testclient1 ssh]$ ssh -vvv testclient2.example.com
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 60: Applying options for *
debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 22 testclient2.example.com
debug1: key_load_public: No such file or directory
debug1: identity file /home/testuser/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/testuser/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/testuser/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/testuser/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/testuser/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/testuser/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/testuser/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/testuser/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: permanently_drop_suid: 1234
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug2: fd 6 setting O_NONBLOCK
debug2: fd 5 setting O_NONBLOCK
debug1: Authenticating to testclient2.example.com:22 as 'testuser'
debug3: hostkeys_foreach: reading file "/var/lib/sss/pubconf/known_hosts"
debug3: record_hostkey: found key type RSA in file /var/lib/sss/pubconf/known_hosts:1
debug3: record_hostkey: found key type RSA in file /var/lib/sss/pubconf/known_hosts:3
debug3: record_hostkey: found key type ECDSA in file /var/lib/sss/pubconf/known_hosts:4
debug3: record_hostkey: found key type ECDSA in file /var/lib/sss/pubconf/known_hosts:6
debug3: record_hostkey: found key type ED25519 in file /var/lib/sss/pubconf/known_hosts:7
debug3: record_hostkey: found key type ED25519 in file /var/lib/sss/pubconf/known_hosts:9
debug3: load_hostkeys: loaded 6 keys from testclient2.example.com
debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss-cert-v01(a)openssh.com,ssh-dss
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm(a)openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm(a)openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128(a)openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128(a)openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib(a)openssh.com,zlib
debug2: compression stoc: none,zlib(a)openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128(a)openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128(a)openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib(a)openssh.com
debug2: compression stoc: none,zlib(a)openssh.com
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305(a)openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305(a)openssh.com MAC: <implicit> compression: none
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:04F5INVrYOenS32GxvfsU8o8z70Fta/J7alUuSG+KpE
debug3: hostkeys_foreach: reading file "/var/lib/sss/pubconf/known_hosts"
debug3: record_hostkey: found key type RSA in file /var/lib/sss/pubconf/known_hosts:1
debug3: record_hostkey: found key type RSA in file /var/lib/sss/pubconf/known_hosts:3
debug3: record_hostkey: found key type ECDSA in file /var/lib/sss/pubconf/known_hosts:4
debug3: record_hostkey: found key type ECDSA in file /var/lib/sss/pubconf/known_hosts:6
debug3: record_hostkey: found key type ED25519 in file /var/lib/sss/pubconf/known_hosts:7
debug3: record_hostkey: found key type ED25519 in file /var/lib/sss/pubconf/known_hosts:9
debug3: load_hostkeys: loaded 6 keys from testclient2.example.com
debug1: Host 'testclient2.example.com' is known and matches the ECDSA host key.
debug1: Found key in /var/lib/sss/pubconf/known_hosts:4
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug2: key: /home/testuser/.ssh/id_rsa ((nil))
debug2: key: /home/testuser/.ssh/id_dsa ((nil))
debug2: key: /home/testuser/.ssh/id_ecdsa ((nil))
debug2: key: /home/testuser/.ssh/id_ed25519 ((nil))
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-keyex
debug3: remaining preferred: gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-keyex
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug2: we did not send a packet, disable method
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug3: send packet: type 50
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug3: send packet: type 50
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug2: we did not send a packet, disable method
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/testuser/.ssh/id_rsa
debug3: no such identity: /home/testuser/.ssh/id_rsa: No such file or directory
debug1: Trying private key: /home/testuser/.ssh/id_dsa
debug3: no such identity: /home/testuser/.ssh/id_dsa: No such file or directory
debug1: Trying private key: /home/testuser/.ssh/id_ecdsa
debug3: no such identity: /home/testuser/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /home/testuser/.ssh/id_ed25519
debug3: no such identity: /home/testuser/.ssh/id_ed25519: No such file or directory
debug2: we did not send a packet, disable method
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug3: send packet: type 50
debug2: we sent a keyboard-interactive packet, wait for reply
debug3: receive packet: type 60
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 1
Password:
Any tips for troubleshooting this?
Thanks,
Ryan
5 years, 7 months
[Ubuntu 18.04] Inappropriate directory permission caused inability signing into webui on a fresh install
by Quan Zhou
Hi,
I had a problem with webui a while ago where the error was "Login
failed due to an unknown reason". The OS was Ubuntu 18.04, fresh
install. The freeipa was installed with `apt install freeipa-server`
and the version was '4.7.0~pre1+git20180411-2ubuntu2'.
Pulling the logs from /var/log/apache2/error.log clearly shows that
pkinit failed due to inability to read /var/lib/krb5kdc/kdc.crt:
```
[Fri Aug 03 16:26:50.741160 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] mod_wsgi (pid=21592):
Exception occurred processing WSGI script '/usr/share/ipa/wsgi.py'.
[Fri Aug 03 16:26:50.741202 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] Traceback (most recent
call last):
[Fri Aug 03 16:26:50.741224 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] File
"/usr/share/ipa/wsgi.py", line 57, in application
[Fri Aug 03 16:26:50.741257 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] return
api.Backend.wsgi_dispatch(environ, start_response)
[Fri Aug 03 16:26:50.741266 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] File
"/usr/lib/python2.7/dist-packages/ipaserver/rpcserver.py", line 265,
in __call__
[Fri Aug 03 16:26:50.741286 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] return
self.route(environ, start_response)
[Fri Aug 03 16:26:50.741292 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] File
"/usr/lib/python2.7/dist-packages/ipaserver/rpcserver.py", line 277,
in route
[Fri Aug 03 16:26:50.741300 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] return app(environ,
start_response)
[Fri Aug 03 16:26:50.741306 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] File
"/usr/lib/python2.7/dist-packages/ipaserver/rpcserver.py", line 935,
in __call__
[Fri Aug 03 16:26:50.741313 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705]
self.kinit(user_principal, password, ipa_ccache_name)
[Fri Aug 03 16:26:50.741319 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] File
"/usr/lib/python2.7/dist-packages/ipaserver/rpcserver.py", line 971,
in kinit
[Fri Aug 03 16:26:50.741326 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705]
pkinit_anchors=[paths.KDC_CERT, paths.KDC_CA_BUNDLE_PEM],
[Fri Aug 03 16:26:50.741333 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] File
"/usr/lib/python2.7/dist-packages/ipalib/install/kinit.py", line 125,
in kinit_armor
[Fri Aug 03 16:26:50.741343 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] run(args, env=env,
raiseonerr=True, capture_error=True)
[Fri Aug 03 16:26:50.741349 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] File
"/usr/lib/python2.7/dist-packages/ipapython/ipautil.py", line 572, in
run
[Fri Aug 03 16:26:50.741358 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] p.returncode,
arg_string, output_log, error_log
[Fri Aug 03 16:26:50.741390 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] CalledProcessError:
CalledProcessError(Command ['/usr/bin/kinit', '-n', '-c',
'/var/run/ipa/ccaches/armor_21592', '-X', 'X509_anchors=FILE:/
var/lib/krb5kdc/kdc.crt', '-X',
'X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem']
returned non-zero exit status 1: "kinit: Pre-authentication failed:
Cannot open file '/var/lib/krb5kdc/kdc.crt': Permission denied while
getting initial credentials\\n")
```
despite that correct permission been set on the '/var/lib/krb5kdc/kdc.crt' file.
```
$ sudo ls -la /var/lib/krb5kdc
total 20
drw------- 2 root root 4096 Aug 3 15:08 .
drwxr-xr-x 52 root root 4096 Aug 3 14:16 ..
-rw-r--r-- 1 root root 2217 Aug 3 15:50 cacert.pem
-rw-r--r-- 1 root root 1590 Aug 3 15:08 kdc.crt
-rw------- 1 root root 1704 Aug 3 15:08 kdc.key
```
It took me a few days to figure out that it was the `/var/lib/krb5kdc`
directory whom has no execution perms set, so that the contents within
cannot be accessed by the wsgi process that caused the problem, after
'sudo chmod a+x /var/lib/krb5kdc' the problem is then resolved.
I wonder if this issue can be fixed by the package maintainer or it's
a problem with krb5kdc. Thanks for reading.
--
Regards,
Quan Zhou
E271C0D1BD90012B8D8EECF6F822BC9F8E1C35C8
quanzhou822(a)gmail.com
https://keybase.io/qzhou
5 years, 7 months
error keep continue comes out after shutdown for a week
by barrykfl@gmail.com
Hi All;
One of server of cluster shutdown for a week now return normal .
But the comes as below:
I already reintialize it worked success but the error keep log in the log
file
it already make the log size big.
The remote replica has a different database generation ID than the local
database. You may have to reinitialize the remote replica, or the local
replica.
ARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=caToABC.xxx.com"
(ABC:389):
Thx
Barry
5 years, 7 months
stop lookups to trusted AD domain for certain accounts
by Mike Conner
I'm looking for advice on the best way to tackle a problem I'm encountering. I have a box which uses IPA/AD for authentication. SSH is running and open and all users should be able to log in. The box sees quite a bit of malicious access attempts - each of these attempts is having its (false) credentials sent to AD for verification. This has resulted in some AD service accounts being locked out due to too many failed login attempts. How can I configure this box so that no lookups are performed on AD for a list of accounts that I specify?
5 years, 7 months
FreeIPA replica
by Alfredo De Luca
Hi all.
I am trying to add a replica on a freeIPA Server lev 1 (version 4.5.4 on
Centos 7) but I get the following error;
ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR
Cannot promote this client to a replica. Local domain 'digit.test' does
not match IPA domain 'mytestdomain.it'.
Now I know that on IPA server lev 1 you cannot add a replica from the
server so that's why I tried
1. ipa-client-install (gone well)
2. ipa-replica-install (with errors)
Any idea?
--
*Alfredo*
5 years, 7 months