SSO of webapps on Firefox Android
by Alex Corcoles
Hi,
I've managed to integrate some webapps with FreeIPA nicely, both using
mod_auth_gssapi and Ipsilon. Both work great on computers joined to
FreeIPA, I am signed in automatically without typing my password.
Can a similar experience be achieved on Firefox Android? I can log in
putting my password, but both methods require to type in my password (and
quite often- when Firefox is restarted I get prompted the password again
and again).
I was thinking of using the FreeIPA CA to create a user/device certificate,
but I see several drawbacks:
* It is a bit clunky to set up. Maybe there's some OSS MDM I could use to
push the certificate...
* Ipsilon does not support it- so I should do it all in Apache doing the
certificate authentication in addition to mod_auth_gssapi
Maybe there are other methods? I see Keycloak has support for WebAuth...
but I've found Ipsilon much easier to set up...
Cheers,
Álex
--
___
{~._.~}
( Y )
()~*~() mail: alex at corcoles dot net
(_)-(_) http://alex.corcoles.net/
4 years, 4 months
OpenSSH CA with FreeIPA dogtag
by Vinícius Ferrão
Hello,
I would like to know if someone was able to use OpenSSH with certificates managed from the Dogtag CA of FreeIPA.
My goal is to be able to issue certificates for users and perhaps using host keys generated from this CA. I know this may be redundant since FreeIPA already manage host keys, but since the CA is already in-place, why not?
My question is just to know if someone made this, or if someone already tried this and it was broken or unsupported.
Thanks all.
PS: If someone want to just say: leave that, it’s useless. I’m open to hear about it.
4 years, 4 months
ipa-client slows down connections within the container
by Dmitry Perets
Hi,
Really weird issue...
We build a docker container to run some ansible playbooks within it.
We notice, that IF the container has "ipa-client" package installed, there is a HUGE performance degradation to execute the same playbook.
E.g. 20 seconds without ipa-client vs 2 minutes with ipa-client (6 times worse!).
Note that:
- We DO NOT enroll the container. We don't run "ipa-client-install" at any point. We just have the "ipa-client" package INSTALLED (like "yum install ipa-client")
- The playbooks DO NOT talk to IPA in any way, neither do they run IPA commands. They are totally unrelated to ipa-client actually.
The delay seems to be during the connection - i.e. it doesn't matter WHAT exactly ansible task does. It gets stuck for all tasks on something like this (note timestamp):
<192.168.1.1> EXEC /bin/sh -c '/usr/bin/python /root/.ansible/tmp/ansible-tmp-1574346920.3942568-62901531545767/AnsiballZ_stat.py && sleep 0'
852 1574346920.65004: opening command with Popen()
852 1574346920.65758: done running command with Popen()
852 1574346920.65791: getting output with communicate()
852 1574346921.00213: done communicating <<<<<< note the delay here, this happens for each task
852 1574346921.00227: done with local.exec_command()
So, JUST HAVING ipa-client installed somehow causes this slowness.
Any idea what ipa-client package can alter in system behavior, if we don't actually enroll in IPA domain?
P.S. You might be wondering WHY we actually have this ipa-client there... well, that's the point: it's totally unrelated to this particular thing... it's just that some of the playbooks need to use IPA commands, that's why we have ipa-client installed. But even NOT the playbook that we are testing above...
---
Regards,
Dmitry Perets
4 years, 4 months
crawling through my logs on my freeipa-servers
by Christof Schulze
While watching my certificates to renew (hopefully not failing again)
and crawling through my logs I found some Warnings on all of my master
and replicas.
Do I have to worry about something the "ocspSigningCert cert-pki-ca" is
one of the certificates expiring in 9 days.
journalctl -u pki-tomcatd@pki-tomcat
on idm1 (Replication Master)
Nov 20 17:13:19 idm1.example.com.example.com[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'enableOCSP' to 'false' did not find a matching property.
Nov 20 17:13:19 idm1.example.com[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'ocspResponderURL' to 'http://idm1.example.com:9080/ca/ocsp' did not
find a matching property.
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'ocspResponderCertNickname' to 'ocspSigningCert cert-pki-ca' did not
find a matching property.
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'ocspCacheSize' to '1000' did not find a matching property.
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'ocspMinCacheEntryDuration' to '60' did not find a matching property.
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'ocspMaxCacheEntryDuration' to '120' did not find a matching property.
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'ocspTimeout' to '10' did not find a matching property.
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'strictCiphers' to 'true' did not find a matching property.
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'sslOptions' to 'ssl2=false,ssl3=false,tls=true' did not find a matching
property.
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'ssl2Ciphers' to
'-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_C
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'ssl3Ciphers' to
'-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'tlsCiphers' to
'-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_3DES
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'sslVersionRangeStream' to 'tls1_0:tls1_2' did not find a matching property.
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'sslVersionRangeDatagram' to 'tls1_1:tls1_2' did not find a matching
property.
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'sslRangeCiphers' to
'-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'serverCertNickFile' to
'/var/lib/pki/pki-tomcat/conf/serverCertNick.conf' did not find a
matching property.
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'passwordFile' to '/var/lib/pki/pki-tomcat/conf/password.conf' did not
find a matching property.
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'passwordClass' to 'org.apache.tomcat.util.net.jss.PlainPasswordFile'
did not find a matching property.
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.catalina.startup.SetAllPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'certdbDir' to '/var/lib/pki/pki-tomcat/alias' did not find a matching
property.
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.tomcat.util.digester.SetPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetPropertiesRule]{Server/Service/Engine/Host} Setting property
'xmlValidation' to 'false' did not find a matching property.
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.tomcat.util.digester.SetPropertiesRule begin
Nov 20 17:13:19 idm1.example.com server[9668]: WARNING:
[SetPropertiesRule]{Server/Service/Engine/Host} Setting property
'xmlNamespaceAware' to 'false' did not find a matching property.
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
com.netscape.cms.tomcat.PKIListener lifecycleEvent
Nov 20 17:13:19 idm1.example.com server[9668]: INFO: PKIListener:
org.apache.catalina.core.StandardServer [before_init]
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.coyote.AbstractProtocol init
Nov 20 17:13:19 idm1.example.com server[9668]: INFO: Initializing
ProtocolHandler ["http-bio-8080"]
Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM
org.apache.coyote.AbstractProtocol init
Nov 20 17:13:19 idm1.example.com server[9668]: INFO: Initializing
ProtocolHandler ["http-bio-8443"]
Nov 20 17:13:20 idm1.example.com server[9668]: Error: SSL cipher
"TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" not recognized by tomcatjss
Nov 20 17:13:20 idm1.example.com server[9668]: Error: SSL cipher
"TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" not recognized by tomcatjss
and the other masters (e.g. idm2)
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'enableOCSP' to 'false' did not find a matching property.
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'ocspResponderURL' to 'http://idm2.example.com:8080/ca/ocsp' did not
find a matching property.
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'ocspResponderCertNickname' to 'ocspSigningCert cert-pki-ca' did not
find a matching property.
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'ocspCacheSize' to '1000' did not find a matching property.
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'ocspMinCacheEntryDuration' to '60' did not find a matching property.
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'ocspMaxCacheEntryDuration' to '120' did not find a matching property.
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'ocspTimeout' to '10' did not find a matching property.
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'strictCiphers' to 'true' did not find a matching property.
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'sslOptions' to 'ssl2=false,ssl3=false,tls=true' did not find a matching
property.
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'ssl2Ciphers' to
'-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'ssl3Ciphers' to
'-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'tlsCiphers' to
'-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_3DE
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'sslVersionRangeStream' to 'tls1_0:tls1_2' did not find a matching property.
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'sslVersionRangeDatagram' to 'tls1_1:tls1_2' did not find a matching
property.
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'sslRangeCiphers' to
'-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WIT
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'serverCertNickFile' to
'/var/lib/pki/pki-tomcat/conf/serverCertNick.conf' did not find a
matching property.
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'passwordFile' to '/var/lib/pki/pki-tomcat/conf/password.conf' did not
find a matching property.
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'passwordClass' to 'org.apache.tomcat.util.net.jss.PlainPasswordFile'
did not find a matching property.
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetAllPropertiesRule]{Server/Service/Connector} Setting property
'certdbDir' to '/var/lib/pki/pki-tomcat/alias' did not find a matching
property.
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetPropertiesRule]{Server/Service/Engine/Host} Setting property
'xmlValidation' to 'false' did not find a matching property.
Nov 20 17:13:15 idm2.example.com server[10334]: WARNING:
[SetPropertiesRule]{Server/Service/Engine/Host} Setting property
'xmlNamespaceAware' to 'false' did not find a matching property.
--
Christof Schulze
Institute of Materials Simulation (WW8)
Department of Materials Science
Friedrich-Alexander-University Erlangen-Nürnberg
Dr.-Mack-Str. 77,
90762 Fürth, Germany
Tel: 0911/65078-65069
Email: christof.schulze(a)fau.de
4 years, 4 months
Current state of Windows client support
by Ian Pilcher
I've long believed that it wasn't possible to use FreeIPA for identity
management with Windows clients (unless one was willing to pay for an
Active Directory server and establish a cross-domain trust).
I recently stumbled on this post, which indicates that it is possible:
https://www.rootusers.com/how-to-login-to-windows-with-a-freeipa-account/
Can anyone speak to whether this is expected to work?
--
========================================================================
Ian Pilcher arequipeno(a)gmail.com
-------- "I grew up before Mark Zuckerberg invented friendship" --------
========================================================================
4 years, 4 months
ipa-ca-agent cert
by N N
Hello!
I have ipa 4.6.4-10, and my certmonger do not update ipa-ca-agent cert.
Subject DN: CN=ipa-ca-agent, O=<my realm>
How I can update it? I have few week before my certificate expire.
I can't find documentation about it.
4 years, 4 months
Replication issue, can't locate CSN, check_ipa_cosistency shows no errors
by Jones, Bob (rwj5d)
Hello,
We have a 3 node multi-master IPA setup. These are running on Red Hat Enterprise Linux Server release 7.7 (Maipo) and all are version:
Name : ipa-server
Arch : x86_64
Version : 4.6.5
Release : 11.el7_7.3
Starting yesterday, we are getting the following messages approximately every 3 seconds from lidm01:
[19/Nov/2019:15:48:24.221023177 -0500] - ERR - agmt="cn=caTolidm02.idm.domain.edu" (lidm02:389) - clcache_load_buffer - Can't locate CSN 5dd2adc0000100070000 in the changelog (DB rc=-30988). If replication stops, the consumer may need to be reinitialized.
[19/Nov/2019:15:48:24.222186079 -0500] - ERR - NSMMReplicationPlugin - send_updates - agmt="cn=caTolidm02.idm.domain.edu" (lidm02:389): Missing data encountered. If the error persists the replica must be reinitialized.
[19/Nov/2019:15:48:25.229931823 -0500] - ERR - agmt="cn=caTolidm03.idm.domain.edu" (lidm03:389) - clcache_load_buffer - Can't locate CSN 5dd2adc0000100070000 in the changelog (DB rc=-30988). If replication stops, the consumer may need to be reinitialized.
[19/Nov/2019:15:48:25.231001956 -0500] - ERR - NSMMReplicationPlugin - send_updates - agmt="cn=caTolidm03.idm.domain.edu" (lidm03:389): Missing data encountered. If the error persists the replica must be reinitialized.
There are no error messages on lidm02 or lidm03. I ran the command 'ipa-replica-manage re-initalize --from lidm01.idm.domain.edu’ on both lidm02 and lidm03. When that did not change anything I ran the command 'ipa-replica-manage re-initalize --from lidm02.idm.domain.edu’ on lidm01. This did not change anything either. I have run restart-dirsrv on all 3 idm servers as well.
Also, here are the ipa-replica-manage list-ruv output on the 3 servers:
Lidm01:
Replica Update Vectors:
lidm01.idm.domain.edu:389: 4
lidm02.idm.domain.edu:389: 8
lidm03.idm.domain.edu:389: 5
Certificate Server Replica Update Vectors:
lidm01.idm.domain.edu:389: 7
lidm02.idm.domain.edu:389: 9
lidm03.idm.domain.edu:389: 6
Lidm02:
Replica Update Vectors:
lidm02.idm.domain.edu:389: 8
lidm01.idm.domain.edu:389: 4
lidm03.idm.domain.edu:389: 5
Certificate Server Replica Update Vectors:
lidm02.idm.domain.edu:389: 9
lidm01.idm.domain.edu:389: 7
lidm03.idm.domain.edu:389: 6
Lidm03:
Replica Update Vectors:
lidm03.idm.domain.edu:389: 5
lidm01.idm.domain.edu:389: 4
lidm02.idm.domain.edu:389: 8
Certificate Server Replica Update Vectors:
lidm03.idm.domain.edu:389: 6
lidm01.idm.domain.edu:389: 7
lidm02.idm.domain.edu:389: 9
check_ipa_consistency shows the following:
+--------------------+----------+----------+----------+-------+
| FreeIPA servers: | lidm01 | lidm02 | lidm03 | STATE |
+--------------------+----------+----------+----------+-------+
| Active Users | 8 | 8 | 8 | OK |
| Stage Users | 0 | 0 | 0 | OK |
| Preserved Users | 0 | 0 | 0 | OK |
| Hosts | 93 | 93 | 93 | OK |
| Services | 13 | 13 | 13 | OK |
| User Groups | 89 | 89 | 89 | OK |
| Host Groups | 15 | 15 | 15 | OK |
| Netgroups | 14 | 14 | 14 | OK |
| HBAC Rules | 41 | 41 | 41 | OK |
| SUDO Rules | 28 | 28 | 28 | OK |
| DNS Zones | 0 | 0 | 0 | OK |
| Certificates | 27 | 27 | 27 | OK |
| LDAP Conflicts | 0 | 0 | 0 | OK |
| Ghost Replicas | 0 | 0 | 0 | OK |
| Anonymous BIND | ON | ON | ON | OK |
| Microsoft ADTrust | True | True | True | OK |
| Replication Status | lidm02 0 | lidm03 0 | lidm02 0 | OK |
| | lidm03 0 | lidm01 0 | lidm01 0 | |
+--------------------+----------+----------+----------+-------+
At this point I’m not sure what to do next as most references to problems like this that I could find were solved with the re-initialize of the replication agreements. I appreciate any help anyone can provide.
Thanks,
—
Bob Jones
Lead Linux Services Engineer
ITS ECP - Linux Services
4 years, 4 months
Differences using sudo with local user on IPA server and client
by Jones, Bob (rwj5d)
Hello all,
In our Nagios system we have some checks that require the nrpe user to use sudo in order to elevate privileges. This works fine on our IPA clients but not on our IPA servers. It appears that on the IPA servers it tries to find the nrpe user as nrpe(a)LIDS.VIRGINIA.EDU, which does not exist, and on the client it’s just the local nrpe user. The nrpe user exists identically in the /etc/passwd and /etc/shadow files on both servers.
Any insight that anyone could give into what is going on here would be greatly appreciated.
Now some relevant info/logs:
Server is running on Red Hat Enterprise Linux Server release 7.7 (Maipo) and is version:
Name : ipa-server
Arch : x86_64
Version : 4.6.5
Release : 11.el7_7.3
Client is running on CentOS Linux release 7.7.1908 (Core) and is version:
Name : ipa-client
Arch : x86_64
Version : 4.6.5
Release : 11.el7.centos.3
The client and server have identical /etc/pam.d/system-auth and /etc/nsswitch.conf files. Here are the sssd.conf files for both.
Server:
--------------------------------------------------------------------------
[domain/idm.domain.edu]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = idm.domain.edu
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ldap_tls_cacert = /etc/ipa/ca.crt
ipa_hostname = lidm01.idm.domain.edu
chpass_provider = ipa
ipa_server = lidm01.idm.domain.edu
ipa_server_mode = True
ignore_group_members = True
ldap_purge_cache_timeout = 0
subdomain_inherit = ignore_group_members, ldap_purge_cache_timeout
dns_discovery_domain = idm.domain.edu
[sssd]
services = nss, sudo, ifp, pam, ssh
domains = idm.domain.edu
[nss]
homedir_substring = /home
override_homedir = /home/%u
entry_negative_timeout = 0
local_negative_timeout = 0
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
allowed_uids = ipaapi, root
[secrets]
[session_recording]
--------------------------------------------------------------------------
Client:
--------------------------------------------------------------------------
[domain/idm.domain.edu]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = idm.domain.edu
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ldap_tls_cacert = /etc/ipa/ca.crt
ipa_hostname = dbm3.it.domain.edu
chpass_provider = ipa
ipa_server = _srv_, lidm01.idm.domain.edu
krb5_auth_timeout = 30
dns_discovery_domain = idm.domain.edu
[sssd]
services = nss, sudo, pam, ssh
domains = idm.domain.edu
[nss]
homedir_substring = /home
override_homedir = /home/%u
entry_negative_timeout = 0
local_negative_timeout = 0
[pam]
pam_id_timeout = 30
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
[secrets]
[session_recording]
--------------------------------------------------------------------------
Okay, here are the pertinent messages in /var/log/secure when nrpe tries to use sudo:
Server:
--------------------------------------------------------------------------
Nov 20 16:56:05 lidm01.idm.domain.edu sudo[15034]: nrpe : unable to open /run/sudo/ts/nrpe : Permission denied ; TTY=unknown ; PWD=/ ; USER=root ; COMMAND=EXAMPLE_COMMAND
Nov 20 16:56:05 lidm01.idm.domain.edu sudo[15034]: pam_unix(sudo:auth): conversation failed
Nov 20 16:56:05 lidm01.idm.domain.edu sudo[15034]: pam_unix(sudo:auth): auth could not identify password for [nrpe]
Nov 20 16:56:05 lidm01.idm.domain.edu sudo[15034]: pam_sss(sudo:auth): authentication failure; logname= uid=995 euid=0 tty= ruser=nrpe rhost= user=nrpe
Nov 20 16:56:05 lidm01.idm.domain.edu sudo[15034]: pam_sss(sudo:auth): received for user nrpe: 10 (User not known to the underlying authentication module)
Nov 20 16:56:05 lidm01.idm.domain.edu sudo[15034]: pam_krb5[15034]: authentication fails for 'nrpe' (nrpe(a)LIDS.VIRGINIA.EDU): User not known to the underlying authentication module (Client not found in Kerberos database)
Nov 20 16:56:07 lidm01.idm.domain.edu sudo[15034]: nrpe : command not allowed ; TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/systemctl start sssd
--------------------------------------------------------------------------
Client:
--------------------------------------------------------------------------
Nov 20 16:58:23 dbm3.it.domain.edu sudo[11533]: nrpe : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=EXAMPLE_COMMAND
Nov 20 16:58:23 dbm3.it.domain.edu sudo[11533]: pam_unix(sudo:session): session opened for user root by (uid=0)
Nov 20 16:58:26 dbm3.it.domain.edu sudo[11533]: pam_unix(sudo:session): session closed for user root
--------------------------------------------------------------------------
Thanks,
—
Bob Jones
Lead Linux Services Engineer
ITS ECP - Linux Services
4 years, 5 months
ipa-replica-install with more than one server
by Dirk Streubel
Hello,
it is possible to run the ipa-replica at the same time with more than just one server.
So, what i mean is this: ipa-replica-install --server=1 --server=b --server=c --setup-dns
--forwarder /192.0.2.1.../
/My state of knowledge is that there is only one server can replica his information at the same
time. After that a second replica with other machines./
/And and of the End with the GUI or in the shell with commands to replica the information to all
servers./
/For example: i have three Servers here and with only one command there is a replica between A<>B,
B<>C and A<>C with any options i have chosen./
/I find nothing in the net about this/
/Regards
/
/Dirk/
/
/
/
/
/
/
/
/
/
/
4 years, 5 months