Using sssd/freeipa and samba: User joe@mds.xyz can mount Samba share in Win 10. Same share fails to mount on a Mac using same user.
by TomK
Hey All,
This might be a bit of an unusual question but perhaps someone here has
seen this scenario.
As per the subject says, user joe(a)mds.xyz can mount Samba share in Win
10. Same share fails to mount on a Mac using same user.
Appears Mac's insist on interpreting the UPN joe(a)mds.xyz as
<USER>@<HOST> instead of just considering the entire string,
"joe(a)mds.xyz" as a user.
Tried both the Mac UI and command line using such things as:
mount_smbfs -d 5 "//MDS.XYZ;joe:<PASS>@192.168.0.125/NFS-joe" /samba/
but the attempt fails to mount instead giving:
[2020/02/25 00:38:25.979467, 4] ../source3/smbd/sec_ctx.c:438(pop_sec_ctx)
pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
[2020/02/25 00:38:25.979543, 3]
../source3/auth/check_samsec.c:399(check_sam_security)
check_sam_security: Couldn't find user 'joe' in passdb.
[2020/02/25 00:38:25.979614, 2]
../source3/auth/auth.c:334(auth_check_ntlm_password)
check_ntlm_password: Authentication for user [joe] -> [joe] FAILED
with error NT_STATUS_NO_SUCH_USER, authoritative=1
[2020/02/25 00:38:25.979779, 2]
../auth/auth_log.c:476(log_authentication_event_human_readable)
Auth: [SMB2,(null)] user [MDS.XYZ]\[joe] at [Tue, 25 Feb 2020
00:38:25.979710 EST] with [NTLMv2] status [NT_STATUS_NO_SUCH_USER]
workstation [MACBOOKPRO-0138] remote host [ipv4:192.168.0.206:52695]
mapped to [MDS.XYZ]\[joe]. local host [ipv4:192.168.0.125:445]
[2020/02/25 00:38:25.980276, 2]
../lib/audit_logging/audit_logging.c:141(audit_log_json)
JSON Authentication: {"timestamp": "2020-02-25T00:38:25.980017-0500",
"type": "Authentication", "Authentication": {"version": {"major": 1,
"minor": 0}, "status": "NT_STATUS_NO_SUCH_USER", "localAddress":
"ipv4:192.168.0.125:445", "remoteAddress": "ipv4:192.168.0.206:52695",
"serviceDescription": "SMB2", "authDescription": null, "clientDomain":
"MDS.XYZ", "clientAccount": "joe", "workstation": "MACBOOKPRO-0138",
"becameAccount": null, "becameDomain": null, "becameSid": null,
"mappedAccount": "joe", "mappedDomain": "MDS.XYZ", "netlogonComputer":
null, "netlogonTrustAccount": null, "netlogonNegotiateFlags":
"0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid":
null, "passwordType": "NTLMv2", "duration": 9826}}
[2020/02/25 00:38:25.980420, 4] ../source3/smbd/sec_ctx.c:438(pop_sec_ctx)
SSSD is configured on the NFS03 servers from which Samba is running.
Authentication works fine on all hosts with SSSD. SSSD in turn is
connected to FreeIPA.
Wondering if anyone has seen this scenario and remembers what the
possible solution may have been to get said mounts working on a Mac?
--
Thx,
TK.
4 years, 1 month
problem with the ipa_pwd_extop plugin when using sssd-ldap with FreeIPA / replace of the passwordExpirationTime attribute with the value “19700101000000Z”
by Chris Paul
I am having a problem with the ipa_pwd_extop plugin when using sssd-ldap with FreeIPA (all providers set to “ldap"). If a user changes their password, they get stuck a password expiration loop where each login or sudo forces a password reset. This happens only with sssd-ldap clients using LDAP providers. It is not a problem for a regular IPA client. One related customization that I have made to the 389DS which is part of FreeIPA. I set "passwordExp: on" in "cn=config". This causes 389DS to interpret passwordExpirationTime and is documented here: https://directory.fedoraproject.org/docs/389ds/design/password-controls.html.
Some more details: It seems to be that if the ipa_pwd_extop plugin is enabled, a user password reset using SSSD-LDAP triggers an replace of the passwordExpirationTime attribute with the value “19700101000000Z”. Whenever passwordExpirationTime is “19700101000000Z” (admin reset), 389DS returns "Server is unwilling to perform (53)” for any BINDs. SSSD-LDAP interprets this as an expired password, which forces a password reset (with "ldap_access_order = pwd_expire_policy_renew, filter” set in /etc/sssd/sssd.conf). When the password is reset, the ipa_pwd_extop resets the passwordExpirationTime attribute with the value “19700101000000Z” which begins another iteration of the loop.
Is this even the right list to ask questions about this problem?
Is this a bug in the plugin or is there some good reason why it replaces the passwordExpirationTime attribute with the value “19700101000000Z”?
Maybe one solution is to turn set "passwordExp: off" in "cn=config", but then we can have account expiration with SSSD-LDAP clients.
I'd appreciate your ideas. Many Thanks,
CP
Chris Paul
Rex Consulting, Inc
5652 Florence Terrace, Oakland, CA 94611
email: chris.paul(a)rexconsulting.net
web: [ http://www.rexconsulting.net/ | http://www.rexconsulting.net ]
phone, toll-free: +1 (888) 403-8996 ext 1
4 years, 1 month
Lost pass to replica's /root/cacert.p12 - can I re-create it? I have present dir manager pass and primary /root/cacert.p12
by Morgan Cox
Hi.
I have a 2 server IPA setup.
The replica was added a while ago.
Today I tried to extract the cert from the /root/cacert.p12 from the replica server - however I have no idea what the dir manager password was at the time I created the replica..
I have the initial dir manager pass for when I setup the primary server and can extract that fine using
# openssl pkcs12 -in /root/cacert.p12 -clcerts -nokeys -out /tmp/cert.crt
However I do not know the pass for the p12 bundle on the replica.
I have the current directory manager also.
What can I do to extract the p12 bundle on the replica ?
i.e can I re-generate it ? Or does it not matter as I have the primary .p12 pass.
Any advice would be welcomed
Thank you.
4 years, 1 month
clients not able to login
by Sunil Phogat
Hello ,
I recently installed freeIPA on ubuntu 18 and tested client both from ubuntu and centos , but except default admin user, I'm not able to login using any user from any client . it says permission denied error
pls guide
4 years, 1 month
Reissue IPA LDAP cert with SAN
by Ian Pilcher
I am trying to get OpenShift to use my FreeIPA installation
(ipa-server-4.6.5-11.el7.centos.4.x86_64) as an identity provider.
OpenShift is refusing to talk to the LDAP server, because its
certificate doesn't contain a subjectAltName.
So I need to re-request/re-issue the certificate with the SAN. Will it
be sufficient to modify the caIPAserviceCert profile to copy the host-
name from the CN to the SAN (as discussed in [1]) and then use
ipa-getcert resubmit?
Will this break anything? (I only have a single IPA server/CA.)
Thanks!
[1]
https://frasertweedale.github.io/blog-redhat/posts/2017-07-11-cn-deprecat...
--
========================================================================
In Soviet Russia, Google searches you!
========================================================================
4 years, 1 month
clients not able to login
by Sunil Phogat
Hello , I recently installed freeIPA on ubuntu 18 and tested client both
from ubuntu and centos , but except default admin user, I'm not able to
login using any user from any client . it says permission denied error pls
guide
4 years, 1 month
ipa reverse dns best practices.
by Kendrick .
Should i create a single reverse zone or should there be zones for each subnet? 10.1.1/24 10.1.2/24 10.1.3/26 10.1.3.192/26 etc? 10.1.1-50/ is the likely used ip range with a few /25-26's
Thanks
Kendrick
4 years, 1 month