Hello the list,
We just had a bit of fuss involved user logins. We're using sssd 1.16.1 on a
client and FreeIPA 4.5.4 (ok, it's really RHIdM)
We had a lot of users having issues logging and/or resetting their passwords
on a host with 2FA enabled, and it turns out when they're using an advanced
SSH client (e.g. MobaXterm) that also starts a SFTP session they can't login
and we see error like:
Sep 11 00:09:05 lander sshd: pam_sss(sshd:auth): received for user
testuser: 4 (System error)
Sep 11 00:09:06 lander sshd: error: PAM: Authentication failure for
testuser from remote.local
If the SFTP file browser is disabled, or it's protocol is set to use SCP
then logins progress normally.
In FreeIPA we've enabled 2FA on a per-host basis and the HBAC rule only
allows sshd services, so if these were the cause of the '4 (System error)'
failures then it'd be much better if the error reports were more meaningful.
Does anyone have any advice on setting up SFTP so that it works (and
ideally, doesn't need repeated entry of credentials).
I would like to use IPA server in heterogeneous environment with Linux servers and Windows workstations.
IPA domain would be used as a primary source of users and groups.
AD domain would be used for management of Widows hosts only (group policies etc.).
I have setup a test network with two-trust between AD and IPA domain and realized, that IPA domain sees AD users but AD domain doesn't see IPA users. Am I missing something or the two-way trust is not two-way in fact?
CentOS 7.5 - IPA server and IPA domain member
Windows Server 2016 Standard - AD server
Windows 10 Pro - AD domain member
I set up a FreeIPA master and replica behind an elastic load balancer in AWS cloud. FreeIPA Clients will be contacting the replica and the master sever through the load balancer so the dns name used when configurting the clients is the ELB CNAME. The problem is when retreiving ldap data and during the authentication, the SSL handshake fails as the certificate sent back from the master or replica has a hostname different than the one used in the sssd ( the ELB CNAME). so the connection is terminated. There is a workaround which is the use reqcert=allow but this bring a security issue with a MITM attack. another solution i found is the use SAN. I was able to add the ELB DNS as a SAN in freeipa servers certificate. i made sure it is there by downloading the certificate and checking that the elb san exist but when testing it the same problem remain. Please help.
in order to be able to use IPA auth for Samba shares, I followed this
IPA and Samba are running on the same server, everything worked fine.
Actually, it still does, but since the upgrade from 7.4 to 7.5 (including
IPA 4.5.0->4.5.4, Samba 4.6.2->4.7.1 and sssd-1.15.2->1.60.0) file
browsing and copying is painfully slow on Mac, Windows and Linux (<10% of
the theoretical maximum). It "feels" as whether there is a timeout after
each file operation.
Nothing in the server logs. Client logs on Linux occasionally show a "CIFS
VFS: ioctl error in smb2_get_dfs_refer rc=-2". Reverting Samba back to
non-IPA auth (dedicated Samba accounts) gives expected performance (near
I'm out of ideas on how to diagnose this. Any hints?
Mit freundlichen Gruessen/With best regards,
I tried to install a CA to the 2nd master a replicafile which was
created on the 1st master (with self-signed CA), with fails with:
ipa : DEBUG stderr=TokenException: Failed to import
EncryptedPrivateKeyInfo to token: (-8152) The key does not support the
What could be wrong here? - Please find the detailed debug log of
ipa-ca-install as attachment.
Thx & b/r
I have a set-up that has many Freeipa servers throughout various regions,
acting as DNS servers throughout these regions.
To set the stage, I, along with my colleagues, are competent in FreeIPA
administration, but we're not ldap experts. We've had a couple scenarios
wherein changes to our IPA environment (adding/removing a host, additions
of zones, etc) have caused momentary DNS outages.
In addition, we are concerned about LDAP issues that could cause named to
not function - we've already gone through an isolated incident where slapd
took a significant amount of time to start, during which that host was
running named, but was not serving any addresses.
For these and many more reasons we'd feel more comfortable running named
from flat files that pull DNS updates from FreeIPA.
My question to the group is whether there will be any impacts to the
FreeIPA system if we convert named to use files rather than bind as a
backend. Ideally, we'd like to avoid creating new machines to function as
DNS servers and just convert the existing FreeIPA servers to use files for
Any comments or questions on the above approach would be welcome - thanks
for your time.
The home directories of several servers in our company are IPA
automounted. About a week ago, this mechanism stopped working properly
on one server. The directory still gets mounted automatically but the
permissions are nobody:nobody.
I thought restarting idmapd or automount could solve the problem.
Neither did. Then I rebooted the machine hoping it could fix things.
That did not help either.
What steps do I need to take in order to find out what the problem is?