I have a server running Proxmox, on which I have a virtual machine
running FreeIPA. I did have this set up running Kerberized NFS, but a
while ago, I rebooted the Proxmox host and now I always get "Permission
Denied" when trying to mount the NFS server.
To give more detail, the Proxmox server (Debian Based) is running
proxmox 5.3-8 (latest version) and is joined to the FreeIPA domain:
# realm list
The NFS server is configured as follows:
# for i in /etc/default/nfs-* /etc/exports; do echo "---- $i"; grep
"^[^#]" $i; done
RPCMOUNTDOPTS="--manage-gids -N 2 -N 3 -d all"
RPCSVCGSSDOPTS=" -v -v -v"
RPCNFSDOPTS=" -d 3"
The server has keys, too (I have tried refreshing these with
`ipa-getkeytab -r -s ipaserver -p nfs/gusteau.darac.org.uk -k
# klist -ke /etc/krb5.keytab
Keytab name: FILE:/etc/krb5.keytab
9 host/gusteau.darac.org.uk(a)GHIBLI.DARAC.ORG.UK (aes256-cts-hmac-sha1-96)
9 host/gusteau.darac.org.uk(a)GHIBLI.DARAC.ORG.UK (aes128-cts-hmac-sha1-96)
9 nfs/gusteau.darac.org.uk(a)GHIBLI.DARAC.ORG.UK (aes256-cts-hmac-sha1-96)
9 nfs/gusteau.darac.org.uk(a)GHIBLI.DARAC.ORG.UK (aes128-cts-hmac-sha1-96)
The client is, for example, my laptop running Debian. It, too, is joined
to the domain:
# realm list
It, too, has these keys:
# klist -ke /etc/krb5.keytab
Keytab name: FILE:/etc/krb5.keytab
And the user has a valid ticket:
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: darac(a)GHIBLI.DARAC.ORG.UK
Valid starting Expires Service principal
03/02/19 19:31:44 04/02/19 19:31:38
However, when I try to mount the server:
# mount -v -t nfs4 -o sec=krb5 gusteau.darac.org.uk:/tank mnt
mount.nfs4: timeout set for Sun Feb 3 19:34:49 2019
mount.nfs4: trying text-based options
mount.nfs4: mount(2): Permission denied
mount.nfs4: access denied by server while mounting
My problem is that I've run out of places to look for errors. I've tried
enabling NFS debugging, but I don't see anything obvious there. I've
also looking in /var/log/krb5kdc.log on the FreeIPA server, but I don't
see any log messages there when the mount is attempted.
Apologies if this isn't the right place to ask about this, but it's one
of these questions of "Is it FreeIPA at fault? Is it Kerberos? Is it my
setup?" and I've got to start somewhere. Many thanks.
I've been banging my head against trying to get FreeRADIUS to work with FreeIPA for WiFi Auth. The good news is that I've learned a ton, the bad news is that I'm quite lost still :)
My main goal is a secure way to do user-based (user/pass) auth on a WiFi network. I've been trying to wrap my head around the differences between EAP-TLS and EAP-TTLS and how different inner and outer tunnels interact with FreeIPA.
I've followed literally every guide, mailing list post, and blog that comes up in the top 20 google results. There's a surprising few, and all seem to share the same genesis. That makes me wonder, is this stuff easy and obvious to most? Or is it rarely done and not really supported?
First question: I think I understand that the most commonly used option is EAP-TLS and PEAP with mschapv2. And that required ntmhashes (I've done the AD trust steps).
Is there a more secure way? Could I do EAP-TTLS with user certs and keep the passwords encrypted end to end to the ldap server? Is there a way that doesn't require the ntmhashes?
Here's what I've done:
1. I've created a radius/host.... service account.
2. I've assigned It a password and can kinit against it
3. That principal and pass are in /mods-enabled/ldap as:
identity = krbprincipalname=radius/ipa.secure.nsnet.us(a)SECURE.MYDOMAIN.US,cn=serv
password = HDdkr%rkd094D!@ekd
(Not my actual pass, but representative of the complexity and characters)
And here's what I get:
>rlm_ldap (ldap): Waiting for bind result...
>rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials
>rlm_ldap (ldap): Opening connection failed (0)
>rlm_ldap (ldap): Removing connection pool
>/etc/raddb/mods-enabled/ldap: Instantiation failed for module "ldap"
I've also tried creating a user account and assigning it access rights to the radius server role and I assigned it rights to read the ntmhashes. That works (binds and radtest works) and can bind, but EAP fails.
Anyone have any tips on getting up and running with FreeRADIUS and WiFi?
What would be a good solution to add systems where the FQDN cannot be
Would it make sense to add a second DNS A Record in the IPA domain for
each of these systems?
Is there any experience on how to deal with such a situation?
Thanks a lot in advance!
Things have been going along smoothly and no issues with FreeIPA until
recently. Consider the following:
ipa-1 <---> ipa-2 <-|-> ipa-3 <---> ipa-4
Stage | Prod
Yes, this was not a perfect design because exactly what I feared
happened. The connection between 2 and 3 got broken and ipa-2 actually
failed an Upgrade and the only way to get it working again was to
re-install ipa-server and make it a replica with ipa-1
The problem is - now I have 2 "separate" environments instead of a
shared one because I cannot figure out a way to get ipa-3 to reconnect
to ipa-2 as a replica agreement.
This is all with latest RHEL 7.6 and 4.6.4-10.el7_6.2 version of IPA on
all 4 nodes. Prior to the upgrade, everything was fine and replication
was running across all 4 nodes. During the upgrade (patching) process
ipa-2 got a database error and it was not detected for 2 days. When you
tried to restart it - it wanted to upgrade the database, the same as all
the other 3 but failed with errors and there seemed to be no way to get
them to sync up. It has been 4 days now. I would love to get all 4
talking again, but because ipa-2 was rebuilt using ipa-1 as the master
it connected to, it won't talk to ipa-3. I was trying several of the new
"topology" commands to try to get them connected, but no luck.
Any ideas on how I might accomplish getting the 2 environments
Can someone please help me to add a picture to the freeipa user, i did the following steps:
1- Create a new file with ldif extension:
2- copy the following lines:
attributeTypes: ( 2.25.286393113211132382417016115830887406220.127.116.11
EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch
X-ORIGIN 'Extending FreeIPA' )
objectclasses: ( 2.25.28639311321113238241701611583088740618.104.22.168 (Not sure if it should be the same than attribute and change 2 by 1 at the end)
NAME 'customPerson' SUP person
MAY ( UsersPicture )
X-ORIGIN 'Extending FreeIPA' )
3- Get kerberos ticket:
4- add the attribute and objectclass to the ldap with the following command (joined webpage About the IDM client tools):
$ldapmodify -D "cn=Directory Manager" -W -p 389 -h ipaserver.example.com -f test.ldif -v
5- Restart freeipa server:
6- ipa config-mod --addattr=ipaUserObjectClasses=object_class_name_added_above
7- Add the attribute to a user
$ ipa user-mod ttest1 --addattr=UsersPicture=path_to_the_picture
8- Verify if the user has the new attribute:
$ipa user-show --all loginname | grep UsersPicture
How to add this attribute to the GUI users to check if the picture is working ?
we have an IPA 4.6.4 environment with an AD Trust configured and everything's working perfectly.
My question is: Is it possible to configure, that extra AD user attributes are transfered? I would need the AD user attribute "mail" with the users email address.
This question came up, after I tried to connect GitLab to IPA and authentication with an AD users fails, because IPA doesn't have the "mail" attribute of the user, so logging is denied. (Authentication on Linux systems is working).
Thanks in advance!
Die Information in dieser E-Mail ist vertraulich und ausschließlich für
den/die benannten Adressaten bestimmt. Ein Zugriff auf diese E-Mail
durch andere Personen als den/die benannten Adressaten ist nicht
gestattet. Sollten Sie nicht der benannte Adressat sein, löschen Sie bitte
Hi there, this is ipa-server-4.4.0-12.0.1 with 389-ds-base-22.214.171.124-11 and suddenly daily backup has started to fail with messages:
2019-01-28T04:10:04Z INFO Backing up ipaca in REALM-COM to LDIF
2019-01-28T04:10:04Z INFO Waiting for LDIF to finish
2019-01-28T04:10:05Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_backup.py", line 300, in run
self.db2ldif(instance, 'ipaca', online=options.online)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_backup.py", line 425, in db2ldif
shutil.move(ldiffile, os.path.join(self.dir, ldifname))
File "/usr/lib64/python2.7/shutil.py", line 301, in move
File "/usr/lib64/python2.7/shutil.py", line 130, in copy2
File "/usr/lib64/python2.7/shutil.py", line 82, in copyfile
with open(src, 'rb') as fsrc:
2019-01-28T04:10:05Z DEBUG The ipa-backup command failed, exception: IOError: [Errno 2] No such file or directory: u'/var/
2019-01-28T04:10:05Z ERROR [Errno 2] No such file or directory: u'/var/lib/dirsrv/slapd-REALM-COM/ldif/REALM-COM-ipaca.ldif'
2019-01-28T04:10:05Z ERROR The ipa-backup command failed. See /var/log/ipabackup.log for more information
And service start fails with messages:
[02/Feb/2019:22:47:37.889779410 -0800] 389-Directory/126.96.36.199 B2016.309.1527 starting up
[02/Feb/2019:22:47:37.906422534 -0800] default_mr_indexer_create: warning - plugin [caseIgnoreIA5Match] does not handle caseExactIA5Match
[02/Feb/2019:22:47:37.921288555 -0800] WARNING: userRoot: entry cache size 10485760 B is less than db size 16932864 B; We recommend to increase the entry cache size nsslapd-cachememsize.
[02/Feb/2019:22:47:37.921943984 -0800] WARNING: ipaca: entry cache size 10485760 B is less than db size 1757741056 B; We recommend to increase the entry cache size nsslapd-cachememsize.
[02/Feb/2019:22:47:37.922701343 -0800] WARNING: changelog: entry cache size 2097152 B is less than db size 82935808 B; We recommend to increase the entry cache size nsslapd-cachememsize.
[02/Feb/2019:22:47:37.925215059 -0800] Detected Disorderly Shutdown last time Directory Server was running, recovering database.
[02/Feb/2019:22:47:37.926177620 -0800] libdb: BDB1546 unable to join the environment
thanks in advance for any help, Zarko
Hopefully this might be a straightforward question.
I have testing instance of FreeIPA version 4.6.4 installed on CentOS 7 from the distro's default repos. I have it configured for a one-way trust to an Active Directory deployment. On the client side, I have installed and configured the freeipa-client package version 4.7.0 on Ubuntu 18.04. This is all basically working as advertised according to the docs.
However, when I log into the client with an AD account and run the `id` command, I'm seeing all of my AD groups listed. Is there a way to have FreeIPA completely ignore all groups from AD when dealing with external users? The ultimate goal (and let me know if this is beyond FreeIPA's capabiltiies) is to ignore/discard all groups in AD and manage users instead by groups in FreeIPA.
One thing I did try was adding these options to the domain section of `sssd.conf` on the FreeIPA server, but they didn't have any effect and I suspect I don't fully understand what they are for:
ignore_group_members = True
subdomain_inherit = ignore_group_members
Thanks for any advice, even if it's "hey, don't do that".
I'm tasked with upgrading our current setup of 3.3.5 on F19 to something more recent and stable (CentOS 7 or CentOS 8).
There were instructions at https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
which is now 404 so I've searched around and found a thread on freeipa-users: https://www.redhat.com/archives/freeipa-users/2016-April/msg00260.html
This thread also points to the above 404 link and another thread: https://www.redhat.com/archives/freeipa-users/2016-April/msg00143.html
When I was reading up on this a year or two ago, there were some guides still up, and I recall there were some commands to check master/replica CA status and promote/demote tha CAs in V3. I can't find these any more.
There is a section "Procedure in FreeIPA < 4.0" here: https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master
But I do not have a /var/lib/pki-ca, only /var/lib/pki/pki-tomcat so that doesn't work.
This was originally a 2-server setup with master-replica, CA and DNS, but due to a firewall misconfiguration after a system upgrade the replication was disconnected for some time. When the split was detected due to us editing the configuration on the master and it not being propagated, we reestablished the connection but things never got back to fully working (I recall we could only edit the configuration on the master, any changes on the replica got lost). We then unenrolled the replica which left us with only the master that is running currently. Everything including enrolling new clients works so IMO this means we're left with the CA master, so we'd want to upgrade this to V4 and have at least 2 replicas back ASAP.
If I understand things correctly, first we need to check if all the certificates are valid and if not renew them, then install a V3 replica, promote/demote the CAs, check if things are working correctly, unenroll the old V3 master, upgrade the replica (now master) to V4 and install additional replicas.
Since this is our production system with ~20 clients, DNS with custom zones, HBAC, etc I'd not like to experiment a lot with it (we do have backups just in case).
I'd highly appreciate if anyone has any suggestions, instructions or an archived upgrade guide somewhere...