FreeIPA Enterprise or Paid Support
by Rohan Talkar
HI,
I am new to FreeIPA & planning to implement it my organization.
I am not sure do FreeIPA have Enterprise or paid support.
Please let me know if any one have idea about this.
Regards,
Ron
2 years, 8 months
Multi-Master addition to existing cluster
by Mark Potter
I have a working FreeIPA cluster and need to start deploying for other
geolocations. I deployed with freeipa-ansible. While I can find docs on
multi-master setups I am struggling to find the initial setup bits.
Would it be best to deploy a new cluster without any knowledge of the
existing cluster and setup replication post-install or is it possible to
just add the hosts as `ipaserver` and `ipareplicas` to the inventory and
rerun the playbook?
I am looking for the best way to set this up without risk to the current
environment. I apologize if I've missed something relatively simple in the
docs.
--
*Mark Potter*
Senior Linux Administrator
DownUnder GeoSolutions
16200 Park Row Drive, Suite 100
Houston TX 77084, USA
tel +1 832 582 3221
markp(a)dug.com
www.dug.com
2 years, 8 months
reduce "normal user" permission
by Scott Serr
Two parts to this question:
Is there a way to disable a normal user's ability to modify their
attributes like their name?
And along those lines, is there a convenient way to reduce what a normal
user sees of other users (via web and cli)?
I'm using version 4.8.
Thank you!
2 years, 8 months
Another 2FA question Debian and Ubuntu
by David Harvey
Hi list,
I've been attempting to get optional 2FA working for my Debian derivatives
so I can run per-host OTP nicely for the more sensitive boxes.
So far:
A user with "password and otp" only allowed in the can login as expected
with the password and OTP concatenated.
A user with both "password" and "password and otp" allowed cannot use the
concatonated practice. Working as expected I think so far from my
readings...
I've then been trying to follow the advice on this thread :
https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...
So that the pre-auth check can be made (the most relevant bit is the
example PAM script I've been shamelessly trying to force into action).
Applying their advice It gets me as far as throwing up the correct prompt
for 2FA users vs password only users, but on trying to auth either with or
without the OTP supplied I can't get in. I see the following errors in the
auth log:
Mar 15 17:36:38 focal-test login[5183]: PAM (login) no control flag supplied
Mar 15 17:36:38 focal-test login[5183]: PAM (login) no module name supplied
Mar 15 17:36:38 focal-test login[5183]: PAM pam_parse: expecting return
value; [...try_first_pass]
Mar 15 17:36:38 focal-test login[5183]: PAM unable to dlopen(sha512):
/lib/security/sha512: cannot open shared object file: No such file or
directory
Mar 15 17:36:38 focal-test login[5183]: PAM adding faulty module: sha512
Mar 15 17:36:38 focal-test login[5183]: PAM (other) no control flag supplied
Mar 15 17:36:38 focal-test login[5183]: PAM (other) no module name supplied
Mar 15 17:36:38 focal-test login[5183]: PAM pam_parse: expecting return
value; [...try_first_pass]
Mar 15 17:36:47 focal-test login[5183]: pam_sss(login:auth): authentication
success; logname=david uid=0 euid=0 tty=/dev/pts/0 ruser= rhost= user=david
Mar 15 17:36:49 focal-test login[5183]: FAILED LOGIN (1) on '/dev/pts/0'
FOR 'david', Permission denied
I've been trying across a spread of ubuntu and Debian versions to try and
ensure I've entertained sufficiently new sssd and libkrb5 versions but am
pretty stumped. Most confusing is the sha512 errors when it's also included
in the default unix pam config.
Feel free to tell me to f@£$ off to the sssd lists!
David
2 years, 8 months
SRV entries remain after removing replica
by Kees Bakker
Hi,
After removing one of the replicas the SRV records in DNS remained. I'm talking
about _kpasswd._udp _kerberos._udp _kerberos._tcp _kerberos-master._udp etc
Two questions.
1. Is this a known problem?
2. Is there a (simple?) command to remove these SRV entries?
I can remove them manually, so it's not a big deal.
--
Kees
2 years, 9 months
integrated Samba to respond under different FQDN - how?
by lejeczek
Hi guys.
I'd like to ask whether Samba should be able to respond
under/via a FQDN different from IPA's default.
I use word "should" deliberately as I have Samba do that, with:
- ipa-server-4.8.7-14.module_el8.3.0+698+d6d67052.x86_64
- samba-4.13.4-1.el8.x86_64
Eg. IPA is: "priv.my.dom.private" and its DNS manages
"us.private" and Samba is completely fine serving Win10
non-enrolled clients under "us.private".
I did not do any "extra" tweaking, certainly I do not
recall, only usual DNS bits.
Now I'm hoping to have the same with:
- ipa-server-4.9.0-1.module_el8.4.0+639+a88aab78.x86_64
- samba-4.13.4-1.el8.x86_64
but having, I believe virtually the same setup, Samba is not
happy.
n
Before I paste any logs, etc. - I guess the question for an
expert, if one happens to read this is - should it work in
as well or that functionality was "taken away" in 4.9.
many thanks, L
2 years, 9 months
different sssd.conf among masters
by lejeczek
Hi guys.
What each option in sssd.conf mean & does I can try to learn
from man pages, but I'd like to ask why would there be
differences between masters?
A) first master
[domain/priv.my.dom.private]
access_provider = ipa
auth_provider = ipa
cache_credentials = True
chpass_provider = ipa
id_provider = ipa
ipa_domain = priv.my.dom.private
ipa_hostname = drunk.priv.my.dom.private
ipa_server = drunk.priv.my.dom.private
ipa_server_mode = True
krb5_store_password_if_offline = True
ldap_tls_cacert = /etc/ipa/ca.crt
B) next master
[domain/priv.my.dom.private]
access_provider = ipa
auth_provider = ipa
autofs_provider = ipa
cache_credentials = True
chpass_provider = ipa
hostid_provider = ipa
id_provider = ipa
ipa_domain = priv.my.dom.private
ipa_hostname = sucker.priv.my.dom.private
ipa_server_mode = True
ipa_server = sucker.priv.my.dom.private
krb5_store_password_if_offline = True
ldap_tls_cacert = /etc/ipa/ca.crt
session_provider = ipa
subdomains_provider = ipa
sudo_provider = ipa
Both config are result of 'ipa-server/replica' process, no
manual interventions and both systems virtually identical in
terms of soft/hardware.
many thanks, L.
2 years, 9 months
ipa-sidgen - when to run
by lejeczek
Hi guys.
When integrating Samba with 'ipa-adtrust-install' the
process asks:
Do you want to run the ipa-sidgen task?
I wonder why that is optional?
Every subsequent run 'ipa-adtrust-install' or when repeated
on other masters does not pause with that question.
many thanks, L.
2 years, 9 months
Joining Windows 7 system to a FreeIPA domain/realm
by dd4321 Dey
Hi
I am trying to join a Windows 7 system to a FreeIPA domain/realm [mydomain.net] rather than being a member of workgroup. So i have added a SRV record to the dnszone [mydomain.net]
DNS Resource Records: mydomain.net.
Record name Record Type Data
....
....
_ldap._tcp.dc._msdcs SRV 0 100 389 idm.mydomain.net.
(https://imgur.com/a/7TouKjs)
I get the desired SRV record by digging the LDAP domain
# dig SRV _ldap._tcp.dc._msdcs.mydomain.net.
(https://imgur.com/a/4TCDFuZ)
However, when i try to join the domain, i encounter following error:
++++++++++++++++++++++++++++++++++++++++++++++++++
DNS was successfully queried for the service location (SRV) resource record used to locate a domain controller for domain "mydomain.net":
The query was for the SRV record for _ldap._tcp.dc._msdcs.mydomain.net
The following domain controllers were identified by the query:
idm.mydomain.net
However no domain controllers could be contacted.
Common causes of this error include:
- Host (A) or (AAAA) records that map the names of the domain controllers to their IP addresses are missing or contain incorrect addresses.
- Domain controllers registered in DNS are not connected to the network or are not running.
++++++++++++++++++++++++++++++++++++++++++++++++++
The A record for the domain controller mydomain.net is resolved correctly as can be seen from the output of dig.
I can confirm domain controller is running and is connected to the network.
Although, it is an Windows 7 issue, i just like to know shall i have to add some more configuration in FreeIPA/LDAP side ?
Regards
2 years, 9 months
ssh login - Illegal empty authtok for user & 7 (Authentication failure)
by lejeczek
Hi guys
I have a fresh re/deployment and users cannot ssh with
passwords.
Snippets of some logs.
...
(2021-03-12 23:16:00): [be[priv.my.dom.private]]
[remove_tree_with_ctx] (0x0020): Cannot open
/var/lib/sss/deskprofile/priv.my.dom.private/me: [2]: No
such file or directory
(2021-03-12 23:16:00): [be[priv.my.dom.private]]
[remove_tree_with_ctx] (0x0020): Cannot open
/var/lib/sss/deskprofile/priv.my.dom.private/me: [2]: No
such file or directory
(2021-03-12 23:18:33): [be[priv.my.dom.private]]
[krb5_auth_send] (0x0020): Illegal empty authtok for user
[me(a)priv.my.dom.private]
(2021-03-12 23:27:56): [be[priv.my.dom.private]]
[krb5_auth_send] (0x0020): Illegal empty authtok for user
[me(a)priv.my.dom.private]
(2021-03-13 3:10:50): [be[priv.my.dom.private]]
[sysdb_range_create] (0x0040): Invalid range, skipping.
Expected that either the secondary base RID or the SID of
the trusted domain is set, but not both or none of them.
(2021-03-13 7:10:50): [be[priv.my.dom.private]]
[sysdb_range_create] (0x0040): Invalid range, skipping.
Expected that either the secondary base RID or the SID of
the trusted domain is set, but not both or none of them.
(2021-03-13 9:08:25): [be[priv.my.dom.private]]
[krb5_auth_send] (0x0020): Illegal empty authtok for user
[me(a)priv.my.dom.private]
(2021-03-13 9:28:16): [be[priv.my.dom.private]]
[krb5_auth_send] (0x0020): Illegal empty authtok for user
[me(a)priv.my.dom.private]
..
of krb5_child.log
..
ailed]
(2021-03-13 9:27:42): [krb5_child[77868]] [map_krb5_error]
(0x0020): 1849: [-1765328353][Decrypt integrity check failed]
(2021-03-13 9:27:48): [krb5_child[77881]]
[get_and_save_tgt] (0x0020): 1720: [-1765328353][Decrypt
integrity check failed]
(2021-03-13 9:27:48): [krb5_child[77881]] [map_krb5_error]
(0x0020): 1849: [-1765328353][Decrypt integrity check failed]
(2021-03-13 9:29:07): [krb5_child[78072]]
[get_and_save_tgt] (0x0020): 1720: [-1765328353][Decrypt
integrity check failed]
(2021-03-13 9:29:07): [krb5_child[78072]] [map_krb5_error]
(0x0020): 1849: [-1765328353][Decrypt integrity check failed]
...
I'm on CentOS Stream with ipa-server-4.9.0.
"Funny" thing is that very first domain deployment worked
but I had 'idranges' created which I realized I needed
different. So I quickly 'uninstalled' and started new with
'--idstart'.
But since then I 'uninstalled' again and again installed
without '--idstart'. At this point I can re-install no
matter how and the problem persists, ssh with password does
not work.
many thanks, L.
2 years, 9 months