docker-compose and unnatended install
by Petar Kozić
Hi,
does somebody know how can I do unnatended ipa-server-install with
docker-compose ?
I tried to add file ipa-server-install-options in /data (/var/lib/ipa-data)
with this options:
--realm=EXAMPLE.TEST
--ds-password=The-directory-server-password
--admin-password=The-admin-password
as I saw here, but without success.
https://hub.docker.com/r/freeipa/freeipa-server/
If someone do that before please can share info :)
Thanks.
*—*
*Petar Kozić*
5 years
Scripting host certificate creation
by Ian Pilcher
I am trying to script the creation of a bunch of host certificates.
Unlike the web UI, the CLI seems to require two separate steps to do
this. (Please correct me if I'm wrong about this.)
After I generate a key and CSR, I create a certificate with
'ipa cert-request'. I am using host/${HOSTNAME}@${REALM} as the
principal, and I am saving the certificate with the --certificate-out
option.
Now I apparently need to use 'ipa host-add-cert' to add the certificate
to the host, but this requires that the certificate be passed in base64
format on the command line. I'm sure I can figure out how to do this
with some combination of sed, tr, etc., but this seems excessively
painful. Is there really not a way to do this in a single step or feed
a PEM-encoded certificate to 'ipa host-add-cert'?
--
========================================================================
Ian Pilcher arequipeno(a)gmail.com
-------- "I grew up before Mark Zuckerberg invented friendship" --------
========================================================================
5 years
Logon returns Insufficient system resources exist to complete the requested service.
by Vex Mage
Hello,
I've personally been using FreeIPA for some time and I love it
immensely. I thought I'd start a post here due to the direction my
troubleshooting has gone instead of the Samba mailing list. Allow me to
explain what I've done, why I've done it and then the problem I'm having.
I just recently started working for a school and the school has some
Windows labs. A problem that has come to my attention is that the OpenLDAP
to Samba3 NT4 domain they've been using for years is no longer compatible
with Windows 10. To dispel any illusion, I'm not trying to get the NT4
domain working nice with Windows 10. Additionally Samba4 has changed its
design structure such that OpenLDAP, or really any LDAP server except
Samba4's internal LDAP server, will no longer work for the Active Directory.
The school would like the Windows machines in the labs to authenticate
students via their OpenLDAP credentials. I am open to alternatives but the
closest thing I found was adding local users on each Windows workstation
and having them authenticate to the FreeIPA server. The problem here is
that users will continually be added and deleted. The Samba project would
have us go all in with Samba4's internal LDAP server. While I'm not
directly knocking that, since from my testing it seems to be quite
functional, the upheaval would be tremendous. Fortunately we were already
looking into switching to 389 before I came on so I've been touting the
possibility of replacing OpenLDAP with FreeIPA before this Samba4 issue. A
solution I thought should work is to use a trust between a FreeIPA (IPA)
and a Samba4 Active Directory (AD). I've since configured both and have
created that trust.
I have a Windows 10 machine connected to the Samba4 domain. When I
attempt to logon with an account from the IPA domain I am presented with
"Insufficient system resources exist to complete the requested service." At
first I took this message at face value and increased the memory of the
workstation from which I'm trying to logon. There are few results from a
Google search about this error without focusing on local memory. After
reading and troubleshooting I believe this is a failure may be in the
Kerberos InitializeSecurityContext function that's producing
SEC_E_INSUFFICIENT_MEMORY, specifically on the Windows workstation and
seemingly not coming from Samba4 AD.
A couple things I've noticed; when I attempt to login as user@ipa if
the password is wrong Windows tell me my password is incorrect. If I use
the correct password I'm presented with that "Insufficient system resources
exist to complete the requested service." The Event Viewer only shows me a
generic logon error message. When I look at the Kerberos logs on both
systems I see on AD that the 'Realm not local to KDC' and a 'No matching
key in entry' but on IPA I see 'Additional pre-authentication required',
then AS_REQ ISSUE and finally TGS_REQ ISSUE.
I continued to do a tcpdump on port 88 to see who was directly
communicating to the FreeIPA server and I found that the Windows
workstation was making a direct Kerberos request. I then expanded my
tcpdump to include all traffic from the workstation and upon another logon
attempt only port 88 was used to communicate to FreeIPA. I therefore think
that this is a Kerberos specific problem and not necessarily a Samba4
problem. Unfortunately I'm not knowledgeable enough in Kerberos to identify
what's going on.
I don't know what information I should present, such as configs or
logs. Whatever is needed I can provide. I greatly appreciate any help,
advice or potentially other non management nightmare solutions! Thank you
all very much!
[root@freeipa-dev log]# ipa trustdomain-find ad.school.edu
Domain name: ad.school.edu
Domain NetBIOS name: AD
Domain Security Identifier: S-1-5-21-276971437-2632767696-819257926
Domain enabled: True
----------------------------
Number of entries returned 1
----------------------------
--
Vex
5 years
AD Trust Integration Issue
by Henry Pelke
Good morning,
I have recently setup an environment with FreeIPA 4.6.4-10 using CentOS 7
as the IPA Master. After setting up I joined the IPA master to the local AD
and everything seemed to work fine.
The issue I'm facing is that after adding the external and POSIX group's I
can authenticate to the IPA Master as an AD user but the server with the
IPA client doesn't appear to be able to authenticate AD users.
The client server is unable to run getent or kinit against any ad user and
returns 'Cannot find KDC for realm "<ad domain>"...'
From the krb5kdc log I can see what looks to be an issue with the TGS
request, and the errors TGS_REQ ISSUE: authtime as well as AS_REQ:
NEEDED_PREAUTH additional preauth required.
I have enabled debug logs for SSSD but nothing except sigterms has been
logged so far.
Please let me know if I can send any logs.
Kind regards,
HP
5 years
Directory manager password best practices
by Ian Pilcher
I am setting up a new IPA instance to provide DNS and CA services in a team
lab. I have to decide what to use for the Directory Manager password — our
standard, not very secure root password or something else, which no one
will ever remember.
Any thoughts? Is it still a major project to change the DM password? How
hard is it to recover/reset it these days?
(This will be IPA 4.6 on RHEL 7.)
Thanks!
5 years
Password expired
by mustafa taha
Hi
i want to ask , if there a way allows the admin to provide an account with password expired after certain of time. and after a certain time the password will not valid .
i see there is field named " Password expiration" , how can i control it for specified user ?
5 years
Best practice backuping freeipa in docker
by Petar Kozić
Hi folks.
I’m using freeipa in docker on one VM machine and for now, I satisfied how
that works, but I worried about backup.
Can someone tell me what is best practice for backup ipa which works in
docker?
Do I need to use backup scripts or some different method?
Thank you in advance.
*—*
*Petar Kozić*
5 years
User's primary group set to recently deleted user group
by Devin Roark
Hello,
I have inherited a freeipa cluster and during a cleanup of groups. We
discovered one of the groups that was deleted was set as a couple user's
primary gid in the past, which I'm assuming was a manual process because it
looks like the default behavior is the standard groupname/gid matching the
username/uid in FreeIPA. This causes errors when on enrolled hosts, bash
runs the id command behind the scenes and subsequently breaks some
automated pipelines for these users.
Although doing an `ipa group-find --gid=${CORRESPONDING_UID}` doesn't
return any groups but users still match uid's and gid's, my thinking is if
we modify these two users to use their UID's as their primary group again
the issues will be resolved.
My question is will this have any known unintended consequences?
Thanks,
Devin
5 years
How to move FreeIPA to new server?
by fujisan
Hello,
I just got a new server on which I'd like to install a FreeIPA server.
Today it is installed on the old server.
I just tried to install it with ipa-server-install but of course it
complained saying the DNS domain is handled by the old server.
What is the best way to install FreeIPA on the new server without
disturbing the users too much?
Regards,
F.
5 years
ID-View for AD group to use GECOS umask
by Ronald Wimmer
Afaik it should be possible to set a users umask by putting something
like "umask=0007" in the GECOS field in combination with pam_umask.so.
pam_umask.so seems to be present on our systems. What I do not know is
in which file (at which exact position) I would have to put "session
optional pam_umask.so".
Should it work in general or would pam_umask.so only respect the GECOS
field of local users?
Cheers,
Ronald
5 years