Re: Ipa user can't login via ssh
by Rob Crittenden
Elhamsadat Azarian wrote:
> I tryed to add HBAC rules to my user but it said : some operation
> failed. Users cannot be added when user category = all
Adding list back.
Try something like:
ipa hbactest --user elham --service ssh --host <your host>
There is an equivalent way to do it in the UI.
rob
>
> On Wed, 9 Oct 2019, 17:19 Rob Crittenden, <rcritten(a)redhat.com
> <mailto:rcritten@redhat.com>> wrote:
>
> Kevin Vasko via FreeIPA-users wrote:
> > Have you made sure your “elham” user has the correct permissions
> to access the machines? Take a look in the UI at the
> groups/permissions that user elham has. Take a look at your HBAC
> rules as well. That would be my first recommendation to check if it
> was me.
>
> Right, and the troubleshooting page suggests that (and increasing debug
> logging).
>
> Please provide the output of the things you have already looked at.
>
> rob
>
> >
> > -Kevin
> >
> >> On Oct 9, 2019, at 7:23 AM, Elhamsadat Azarian via FreeIPA-users
> <freeipa-users(a)lists.fedorahosted.org
> <mailto:freeipa-users@lists.fedorahosted.org>> wrote:
> >>
> >> ### Request for enhancement
> >> as a Linux admin i want to login into my ipa client with a user
> that is defined in ipa-server UI.
> >>
> >> ### Issue
> >> I installed Ipa-server and an Ipa-client on CentOS7.6
> >> I defined Internal DNS on ipa-server and i defined A and PTR
> records for client on ipa-server.
> >> now i can see my client in ipa-UI and i defined a user with name
> "elham" and i expect that it can login into ipa-client.
> >> when i login with root in ipa-client and i do sudo elham, it
> works and kinit elham works too but
> >> when i do ssh into ipa-client with this user, it show "Access denied"
> >> i have errors with this context:
> >> pam_reply : authentication failure to the client
> >> pam_sss: authentication falure
> >>
> >> im tired of this issue. please help me if you know the solution.
> >>
> >> #### Steps to Reproduce
> >> 1. define new user "elham" in ipa UI
> >> 2. SSH to ipa-client with elham
> >> 3. access denied
> >>
> >> #### Actual behavior
> >> (what happens)
> >>
> >> #### Expected behavior
> >> login into ipa-client successfully
> >>
> >> #### Version/Release/Distribution
> >> ipa-server 4.6.5-11.el7
> >> ipa-client 4.6.4-10.el7.centos.3
> >> Log files and config files are added below:
> >>
> >>
> >>
> >> krb5.conf
> >> ------------
> >> #File modified by ipa-client-install
> >>
> >> includedir /etc/krb5.conf.d/
> >> includedir /var/lib/sss/pubconf/krb5.include.d/
> >>
> >>
> >> [logging]
> >> default = FILE:/var/log/krb5libs.log
> >> kdc = FILE:/var/log/krb5kdc.log
> >> admin_server = FILE:/var/log/kadmind.log
> >> [libdefaults]
> >> default_realm = LSHS.DC
> >> dns_lookup_realm = false
> >> dns_lookup_kdc = false
> >> rdns = false
> >> ticket_lifetime = 24h
> >> forwardable = yes
> >> allow_weak_crypto = true
> >> default_ccache_name = KEYRING:persistent:%{uid}
> >>
> >> [realms]
> >> LSHS.DC = {
> >> kdc = ipa-irvlt01.example.dc:88
> >> admin_server = ipa-irvlt01.example.dc:749
> >> default_domain = example.dc
> >> }
> >> [domain_realm]
> >> .example.com <http://example.com> = LSHS.DC
> >> example.com <http://example.com> = LSHS.DC
> >> ############################################
> >>
> >>
> >> sssd.conf
> >> -------------
> >> [domain/example.dc]
> >>
> >> cache_credentials = True
> >> krb5_store_password_if_offline = True
> >> ipa_domain = example.dc
> >> id_provider = ipa
> >> auth_provider = ipa
> >> access_provider = ipa
> >> ldap_tls_cacert = /etc/ipa/ca.crt
> >> ipa_hostname = ipacli-irvlt01.example.dc
> >> chpass_provider = ipa
> >> dyndns_update = True
> >> ipa_server = _srv_, ipa-irvlt01.example.dc
> >> dyndns_iface = ens160
> >> dns_discovery_domain = example.dc
> >>
> >> debug_level = 10
> >> [sssd]
> >> ########### AFTER IPA ###################
> >> #services = nss, sudo, pam, ssh
> >> services = nss, pam
> >> config_file_version = 2
> >> #########################################
> >> domains = example.dc
> >>
> >> debug_level = 10
> >> [nss]
> >> homedir_substring = /home
> >>
> >> [pam]
> >> debug_level = 10
> >>
> >> [sudo]
> >>
> >> [autofs]
> >>
> >> [ssh]
> >>
> >> [pac]
> >>
> >> [ifp]
> >>
> >> [secrets]
> >>
> >> [session_recording]
> >>
> >> ##########################################
> >>
> >>
> >> _______________________________________________
> >> FreeIPA-users mailing list --
> freeipa-users(a)lists.fedorahosted.org
> <mailto:freeipa-users@lists.fedorahosted.org>
> >> To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> <mailto:freeipa-users-leave@lists.fedorahosted.org>
> >> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> >> List Guidelines:
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> >> List Archives:
> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> <mailto:freeipa-users@lists.fedorahosted.org>
> > To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> <mailto:freeipa-users-leave@lists.fedorahosted.org>
> > Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines:
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> >
>
4 years, 6 months
automember-add is not clear (at least for me)
by Eugène Adell
Hello,
the documentation (Linux Domain Identity, Authentication, and Policy
Guide for RH 7) clearly says the AUTOMEMBER-RULE is in fact a group
name, but it's misleading and not intuitive at all. Besides, the help
command doesn't mention this.
Maybe this point should be improved. For example by adding the option
--target mentioning explicitly the group name and then allowing the
rule to have a proper name ?
best regards
E.A.
Usage: ipa [global-options] automember-add AUTOMEMBER-RULE [options]
Add an automember rule.
Options:
-h, --help show this help message and exit
--desc=STR A description of this auto member rule
--setattr=STR Set an attribute to a name/value pair. Format is
attr=value. For multi-valued attributes, the command
replaces the values already present.
--addattr=STR Add an attribute/value pair. Format is attr=value. The
attribute must be part of the schema.
--type=['group', 'hostgroup']
Grouping to which the rule applies
--all Retrieve and print all attributes from the server.
Affects command output.
--raw Print entries as stored on the server. Only affects
output format.
4 years, 6 months
IPA's Samba fails to start?
by lejeczek
Hi guys,
I have 3 replica setup and on one Samba fails this way:
Starting Samba SMB Daemon...
[2019/10/12 09:32:06.490263, 0] ipa_sam.c:4385(bind_callback_cleanup)
kerberos error: code=-1765328174, message=Pre-authentication failed:
Invalid argument
[2019/10/12 09:32:06.490570, 0]
../source3/lib/smbldap.c:1052(smbldap_connect_system)
failed to bind to server
ldapi://%2fvar%2frun%2fslapd-DOM-DIM-PRIVATE.socket with dn="[Anonymous
bind]" Error: Local error
(unknown)
[2019/10/12 09:32:07.500639, 0] ipa_sam.c:4385(bind_callback_cleanup)
kerberos error: code=-1765328174, message=Pre-authentication failed:
Invalid argument
[2019/10/12 09:32:08.508557, 0] ipa_sam.c:4385(bind_callback_cleanup)
kerberos error: code=-1765328174, message=Pre-authentication failed:
Invalid argument
[2019/10/12 09:32:09.517142, 0] ipa_sam.c:4385(bind_callback_cleanup)
kerberos error: code=-1765328174, message=Pre-authentication failed:
Invalid argument
[2019/10/12 09:32:10.527122, 0] ipa_sam.c:4385(bind_callback_cleanup)
kerberos error: code=-1765328174, message=Pre-authentication failed:
Invalid argument
[2019/10/12 09:32:11.537833, 0] ipa_sam.c:4385(bind_callback_cleanup)
kerberos error: code=-1765328174, message=Pre-authentication failed:
Invalid argument
[2019/10/12 09:32:12.546879, 0] ipa_sam.c:4385(bind_callback_cleanup)
kerberos error: code=-1765328174, message=Pre-authentication failed:
Invalid argument
[2019/10/12 09:32:13.553883, 0] ipa_sam.c:4385(bind_callback_cleanup)
kerberos error: code=-1765328174, message=Pre-authentication failed:
Invalid argument
[2019/10/12 09:32:14.561250, 0] ipa_sam.c:4385(bind_callback_cleanup)
kerberos error: code=-1765328174, message=Pre-authentication failed:
Invalid argument
[2019/10/12 09:32:15.569197, 0] ipa_sam.c:4385(bind_callback_cleanup)
kerberos error: code=-1765328174, message=Pre-authentication failed:
Invalid argument
[2019/10/12 09:32:16.578139, 0] ipa_sam.c:4385(bind_callback_cleanup)
kerberos error: code=-1765328174, message=Pre-authentication failed:
Invalid argument
[2019/10/12 09:32:17.585719, 0] ipa_sam.c:4385(bind_callback_cleanup)
kerberos error: code=-1765328174, message=Pre-authentication failed:
Invalid argument
[2019/10/12 09:32:18.593443, 0] ipa_sam.c:4385(bind_callback_cleanup)
kerberos error: code=-1765328174, message=Pre-authentication failed:
Invalid argument
[2019/10/12 09:32:19.602907, 0] ipa_sam.c:4385(bind_callback_cleanup)
kerberos error: code=-1765328174, message=Pre-authentication failed:
Invalid argument
[2019/10/12 09:32:20.612149, 0] ipa_sam.c:4385(bind_callback_cleanup)
kerberos error: code=-1765328174, message=Pre-authentication failed:
Invalid argument
[2019/10/12 09:32:21.620243, 0] ipa_sam.c:4385(bind_callback_cleanup)
kerberos error: code=-1765328174, message=Pre-authentication failed:
Invalid argument
[2019/10/12 09:32:22.621690, 0] ipa_sam.c:4696(pdb_init_ipasam)
Failed to get base DN.
[2019/10/12 09:32:22.621818, 0]
../source3/passdb/pdb_interface.c:180(make_pdb_method_name)
pdb backend ipasam:ldapi://%2fvar%2frun%2fslapd-DOM-DIM-PRIVATE.socket
did not correctly init (error was NT_STATUS_UNSUCCESSFUL)
smb.service: main process exited, code=exited, status=1/FAILURE
Failed to start Samba SMB Daemon.
Unit smb.service entered failed state.
smb.service failed.
Any suggestions on how to troubleshoot & fix are very appreciated.
many thanks, L.
4 years, 6 months
Force users to create OTP token on first login
by Russ Long
Is there a way to put a policy or something in place, so when users login for the first time, they are forced to create an OTP Token? We need to force OTP into the system as well as the servers that authenticate with it.
Thanks!
4 years, 6 months
ipa-server-install chrony
by Raul Dias
On Fedora server 30.1.2.
Freeipa 4.8.1-1.fc30
Whats does "no" stands for in?
Do you want to configure chrony with NTP server or pool address? [no]:
--
Att. Raul Dias
4 years, 6 months
Can't resolve external users on clients, but I can on servers
by S Toulmonde
Hi, I setup an IPA realm (under rhel7) with an trust relationship to a Windows domain. All users in AD have an idoverride to override uid and gid.
Originally, everything was working like expected: servers could resolve IPA and external (trusted) users, I could create kerberos tickets, log-in via ssh... Same for IPA clients.
But recently (two weeks ago?), I tried login to an IPA client using an external user and got denied... Debugging, I saw that id and getent wasn't returning any external users, but could return IPA users.
Digging a bit more: the ipa servers themselves could resolve both IPA and external users like before.
I tried fumbling around in the sssd, but to no avail... I bumped the debug level of the sssd to 9 on the client and the server and this is what I can observe:
0) configure sssd on client to only point to a single IPA server (easier to debug), on that specific IPA server, only point to a single AD server, clear cache and logs, restart sssd on server and client
1) on client, issue 'id myuser' (no domain name, I configured use_fully_qualified_names to False for the domain) -> user unknown
2) client logs:
[sssd[be[ipa.domain]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][name=myuser(a)ipa.domain]
-> it then saw it's an external user:
[sssd[be[ipa.domain]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][name=myuser(a)ad.domain]
-> so it sent the request to IPA:
[sssd[be[ipa.domain]]] [ipa_s2n_get_acct_info_send] (0x0400): Sending request_type: [REQ_FULL_WITH_MEMBERS] for trust user [myuser(a)ad.domain] to IPA server
Spoiler-alert: it fails with:
[sssd[be[ipa.domain]]] [sysdb_search_user_by_upn] (0x0400): No entry with upn [myuser(a)ad.domain] found.
On the server-side, I receive the request:
[sssd[be[ipa.domain]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][name=myuser(a)ad.domain]
It resolves the user - fetch all its groups in Windows and seems to process everything correctly (sid resolve...) but I can't find what's the return/status of the request. Seems like this:
(Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection
(Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [get_ldap_conn_from_sdom_pvt] (0x4000): Returning LDAP connection for user lookup.
(Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [sdap_id_op_connect_step] (0x4000): beginning to connect
(Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'sd_ad.domain.root'
(Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [get_server_status] (0x1000): Status of server 'a08238.ad.domain.root' is 'name resolved'
(Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 6 seconds
(Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved
(Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [get_server_status] (0x1000): Status of server 'a08238.ad.domain.root' is 'name resolved'
(Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [be_resolve_server_process] (0x1000): Saving the first resolved server
(Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [be_resolve_server_process] (0x0200): Found address for server a08238.ad.domain.root: [10.121.129.9] TTL 1236
(Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [sssd_async_socket_init_send] (0x4000): Using file descriptor [29] for the connection.
(Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for connecting
(Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x558da736b2f0], connected[1], ops[(nil)], ldap[0x558da7367cb0]
(Thu Oct 10 11:27:32 2019) [sssd[be[ipa.domain]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list
Could you please help me on this? Thanks in advance!
4 years, 6 months
Where does the "admin" user get its privileges from?
by Russell Jones
Hi all,
I am still exploring my default setup, and have noticed that while the
"admin" user is a part of the admins and trust admins group, neither the
user nor those groups have any roles defined on them that I can see.
Where is this special username getting its permissions from?
Thanks for the help!
4 years, 6 months
DNS - classless/subnet reverse zones ?
by lejeczek
hi guys,
when I try to add a zone:
$ ipa dnszone-add --name-from-ip=10.5.4.128/25
Zone name [4.5.10.in-addr.arpa.]:
I see the above. Is what IPA does there correct? Or... what is the
recipe for a classless/subnet reverse zone creation?
many thanks, L.
4 years, 6 months
How to change the timeout of 60 seconds on the login with AD users
by SOLER SANGUESA Miguel
Hi,
Thanks for the tip.
I try to login executing: ssh -l USER(a)AD.DOMAIN HOSTNAME
Unfortunately I have tested with:
LOGIN_TIMEOUT 90
And also changing on sshd_conf:
LogLevel DEBUG3
ClientAliveInterval 600
LoginGraceTime 600
ClientAliveCountMax 3
And on sssd.conf:
ldap_enumeration_search_timeout = 600
But still have a timeout when login process is longer than 60 seconds.
I have enabled nscd and then authentication takes less than 60 s and then works, but it will be great if I can know how that timeout can be configured.
Thanks & Regards.
4 years, 6 months