Old users cannot login to new freeIPA client machine
by Sam Bell
I have a small FreeIPA setup and user login works ok on the client systems. Recently, I wanted to add a new machine as a client.
I loaded Fedora 33 on the machine and installed freeipa-client. Installation seems to be ok and I can see all users with find-user
on the client system. However, when existing users try to log in into the new client machine via ssh, it shows the error permission denied.
These users can login to old client machines and server (to check) without any problems. To debug the problem, I created new user accounts
and they seem to log in with all client machines (old + new) without any trouble. DNS for the machines are set through hosts file.
I don't have deep knowledge about this stuff but after reading some online threads here are few things I tried:
1. Updated to server (Fedora) to latest packages.
2. Made sure new client machine is chrony/ntp synchronized with server.
3. Tried enabling pre-authentication for old user on server.
4. kinit admin; ipa user-find --all lists all freeipa users on new client machine.
5. Set debug_level of sssd to 9.
Checking krb5_child.log shows:
For old users with failed authentication:
[sss_krb5_prompter] (0x4000): sss_krb5_prompter name [(null)] banner [(null)] num_prompts [1] EINVAL.
[sss_krb5_prompter] (0x4000): Prompt [0][Password for user5(a)FREEIPA.LAB].
[krb5_child[2789]] [sss_krb5_prompter] (0x0020): Cannot handle password prompts.
[sss_child_krb5_trace_cb] (0x4000): [2789] 1615347264.001283: Preauth module spake (151) (real) returned: -1765328254/Cannot read password
For newly created users, these logs are bit more detailed and in general, show success of authentication.
I am not sure which part to focus on to debug this problem.
Any help/suggestions are appreciated.
Thank you.
2 years, 9 months
How to set IPA RA key length
by Yevhen Syvachenko
Hi,
Pease help me to install FreeIPA that uses a 8192 bit key length for IPA RA and the hosts' certificates.
Having all the rumor about quantum computers and being a certified paranoid I need to configure a backbone FreeIPA instance with CA key length equal to 15360. Other keys should be no less than 8192 bits.
The following approach does the trick for most certificates except IPA RA and the hosts' certificates that are still 2048.
# ipa-server-install --pki-config-override $PWD/pki_override.cfg
Where pki_override.cfg is created using:
# cat > pki_override.cfg <<EOF
[DEFAULT]
pki_admin_key_algorithm=SHA512withRSA
pki_admin_key_size=8192
pki_admin_key_type=rsa
pki_audit_signing_key_algorithm=SHA512withRSA
pki_audit_signing_key_size=15360
pki_audit_signing_key_type=rsa
pki_audit_signing_signing_algorithm=SHA512withRSA
pki_sslserver_key_algorithm=SHA512withRSA
pki_sslserver_signing_algorithm=SHA512withRSA
pki_sslserver_key_size=8192
pki_sslserver_key_type=rsa
pki_subsystem_key_algorithm=SHA512withRSA
pki_subsystem_signing_algorithm=SHA512withRSA
pki_subsystem_key_size=15360
pki_subsystem_key_type=rsa
[CA]
pki_ca_signing_key_algorithm=SHA512withRSA
pki_ca_signing_key_size=15360
pki_ca_signing_key_type=rsa
pki_ca_signing_signing_algorithm=SHA512withRSA
pki_ocsp_signing_key_algorithm=SHA512withRSA
pki_ocsp_signing_key_size=15360
pki_ocsp_signing_key_type=rsa
pki_ocsp_signing_signing_algorithm=SHA512withRSA
[KRA]
pki_storage_key_algorithm=SHA512withRSA
pki_storage_key_size=15360
pki_storage_key_type=rsa
pki_storage_signing_algorithm=SHA512withRSA
pki_transport_key_algorithm=SHA512withRSA
pki_transport_key_size=15360
pki_transport_key_type=rsa
pki_transport_signing_algorithm=SHA512withRSA
[OCSP]
pki_ocsp_signing_key_algorithm=SHA512withRSA
pki_ocsp_signing_key_size=15360
pki_ocsp_signing_key_type=rsa
pki_ocsp_signing_signing_algorithm=SHA512withRSA
EOF
I will very appreciate it if we avoid debates about the necessary key length.
2 years, 9 months
FreeIPA Active Directory trust configuration issues
by iulian roman
Hello,
I try to configure trust between a FreeIPA domain and Active Directory. They are both in different domains (ipa domain: ipadev.test.local , ad domain: iam.intern ) and use external DNS. I have configured/verified all prerequisites, but when I run ipa trust-add command, I get the following error:
ipa: ERROR: AD domain controller complains about communication sequence. It may mean unsynchronized time on both sides, for example
I have enabled debug for samba but I cannot make much sense from the debug information in error.log :
s4_tevent: Added timed event "composite_trigger": 0x7f9324240e30
s4_tevent: Ending timer event 0x7f932424ed50 "composite_trigger"
s4_tevent: Running timer event 0x7f9324240e30 "composite_trigger"
s4_tevent: Ending timer event 0x7f9324240e30 "composite_trigger"
s4_tevent: Added timed event "connect_multi_timer": 0x7f9324240cc0
s4_tevent: Schedule immediate event "tevent_req_trigger": 0x7f9324403310
s4_tevent: Run immediate event "tevent_req_trigger": 0x7f9324403310
s4_tevent: Destroying timer event 0x7f9324240cc0 "connect_multi_timer"
Socket options:
SO_KEEPALIVE = 0
SO_REUSEADDR = 0
SO_BROADCAST = 0
TCP_NODELAY = 1
TCP_KEEPCNT = 9
TCP_KEEPIDLE = 300
TCP_KEEPINTVL = 75
IPTOS_LOWDELAY = 0
IPTOS_THROUGHPUT = 0
SO_REUSEPORT = 0
SO_SNDBUF = 2626560
SO_RCVBUF = 1061808
SO_SNDLOWAT = 1
SO_RCVLOWAT = 1
SO_SNDTIMEO = 0
SO_RCVTIMEO = 0
TCP_QUICKACK = 1
TCP_DEFER_ACCEPT = 0
s4_tevent: Added timed event "tevent_req_timedout": 0x7f932424ed50
s4_tevent: Schedule immediate event "tevent_queue_immediate_trigger": 0x7f9324240cc0
s4_tevent: Run immediate event "tevent_queue_immediate_trigger": 0x7f9324240cc0
s4_tevent: Destroying timer event 0x7f932424ed50 "tevent_req_timedout"
s4_tevent: Schedule immediate event "tevent_req_trigger": 0x7f932425c370
s4_tevent: Run immediate event "tevent_req_trigger": 0x7f932425c370
s4_tevent: Added timed event "tevent_req_timedout": 0x7f9324016970
Starting GENSEC mechanism spnego
SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT
s4_tevent: Schedule immediate event "tevent_req_trigger": 0x7f9324403310
s4_tevent: Run immediate event "tevent_req_trigger": 0x7f9324403310
s4_tevent: Destroying timer event 0x7f9324016970 "tevent_req_timedout"
s4_tevent: Destroying timer event 0x7f932401f730 "dcerpc_connect_timeout_handler"
[Tue Mar 09 09:51:12.685725 2021] [wsgi:error] [pid 29053:tid 140270172727040] [remote 10.30.214.119:36488] ipa: INFO: [jsonserver_session] cifs/ipadev01.test.local(a)IPADEV.TEST.LOCAL: trust_add/1(u'IAM.INTERN', trust_type=u'ad', realm_admin=u'admin', realm_passwd=u'********', realm_server=u'10.30.201.46', version=u'2.232'): RemoteRetrieveError
Any idea what should I look into ?
2 years, 9 months
uninstall - Deleting this server will leave your installation without a CRL generation master
by lejeczek
Hi guys.
I'm trying to remove a master from my domain and I get:
-> $ ipa-server-install --uninstall --unattended
Deleting this server will leave your installation without a
CRL generation master.
ipapython.admintool: ERROR Aborting uninstall operation.
ipapython.admintool: ERROR The ipa-server-install command
failed. See /var/log/ipaserver-uninstall.log for more
information
There are two full-KRA masters in the domain so that is bit
puzzling to me.
Would anybody care to share some ideas as to why that one
master is unhappy?
many thanks, L.
2 years, 9 months
Re: ipausers unable to sudo
by Anestis Karampatziakis
Hi Albert,
Did you by any chance find a solution to this issue?
We are having the same issue over here.
Thanks,
Anestis
2 years, 9 months
Speeding up installation?
by Dominik Vogt
Installing the ipa-server on our VMs takes about 13 to 14 minutes.
We have to do this often during development. Stupid question: Is
there a way to speed this up substantially? More memory, more
CPUs or whatever?
Ciao
Dominik ^_^ ^_^
--
Dominik Vogt
2 years, 9 months
/var/log/krb5kdc.log server not found, how to do a kinit or krb5.conf that freeipa likes better
by Jelle de Jong
Hello everybody,
Can someone help how to do a kinit or change my krb5.conf so freeipa
does not create "Server not found in Kerberos database" warnings
flooding the logs?
After freeipa crashed because root / was 100% filled due to
/var/log/krb5kdc.* total size being more then 30GB I found that the log
is full with:
[root@freeipa01 ~]# tail -n 2 /var/log/krb5kdc.log
Mar 06 20:54:42 freeipa01.powercraft.lan krb5kdc[122009](info): TGS_REQ
(6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20),
camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17),
aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25)})
192.168.25.22: UNKNOWN_SERVER: authtime 0, etypes {rep=UNSUPPORTED:(0)}
nextcloud(a)POWERCRAFT.LAN for krbtgt/(null)(a)POWERCRAFT.LAN, Server not
found in Kerberos database
[root@nextcloud01 ~]# sudo -u apache kinit -r 14d -l 7d
nextcloud(a)POWERCRAFT.LAN
I create a kerberos ticket with the above command to create a ticket for
apache with nextcloud to use to access samba (libsmbclient) with
kerberos as user nextcloud (samba01 and nextcloud01 are both ipa clients)
[root@nextcloud01 ~]# sudo -u apache klist
Ticket cache: KEYRING:persistent:48:48
Default principal: nextcloud(a)POWERCRAFT.LAN
Valid starting Expires Service principal
03/06/21 19:04:04 03/07/21 19:03:14
cifs/samba01.powercraft.lan(a)POWERCRAFT.LAN
renew until 03/13/21 19:03:14
03/06/21 19:03:14 03/07/21 19:03:14 krbtgt/POWERCRAFT.LAN(a)POWERCRAFT.LAN
renew until 03/13/21 19:03:14
[root@nextcloud01 ~]# cat /etc/krb5.conf
#File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = POWERCRAFT.LAN
dns_lookup_realm = true
dns_lookup_kdc = true
rdns = false
dns_canonicalize_hostname = false
# ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
# krb5_ccname_template = FILE:%d/krb5cc_%U
[realms]
POWERCRAFT.LAN = {
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.powercraft.lan = POWERCRAFT.LAN
powercraft.lan = POWERCRAFT.LAN
nextcloud01.powercraft.lan = POWERCRAFT.LAN
[
Thank you in advance,
Kind regards,
Jelle de Jong
2 years, 9 months
Jira LDAP integration with JIRA
by Kaspars Tuna
I am working on integrating a Jira instance with a freeIPA instance trough LDAP to retrieve all the users being stored in the freeIPA user directory. I can manage to retrieve all the user, but I cannot seem to be able to retrieve the user groups/memberships, the "Test get user's memberships : Failed" seems to fail all the time with no particular info in the jira-software/logs/atlassian-jira.log file. No luck finding any other resources online, has anybody encountered such issues if so what did you do?
The schema I am using is bellow :
Directory type : LDAP, OpenLDAP (have also attempted to use LDAP with internal authentication, which doesn't give me any groups either)
base DN:cn=users,cn=accounts,dc=example,dc=io
Read Only, with Local groups checked and adding to jira-software -users by default.
Use schema - all user info is being retrieved, so no issue
Group Schema
Group Object Class : groupOfNames
Group Object Filter:(objectclass=groupOfNames)
Group Name attribute: cn
Group Description attribute : description
Membership schema
Group Memebers attribute : Member
User Membership attribute: memberOf
freeIPA user has fields memberOf: cn=group-example, cn=groups, cn=accounts, dc=example, dc=com
and groups has member:cn=usere, cn=accounts, cn=users, dc=example, dc=com
2 years, 9 months
Missing mandatory attribute ipaNTSecurityIdentifier.
by Lachlan Simpson
Last week I was having SSSD issues and Sumit was sharp enough to pick out that I didn't allow enough RIDs.
( https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahoste... )
I increase the range by 5,000,000 via the GUI, restarted all two SSSD services (test ipa server, test client) after clearing their caches and it started to work.
For reasons, the IPA test server was power cycled and when it came back up, IPA wont start. `ipactl start` aborts because "Failed to start smb Service"
I am seeing the following in the samba logs:
[2021/02/23 14:57:23.259648, 0] ../../source3/smbd/server.c:1782(main)
smbd version 4.12.3 started.
Copyright Andrew Tridgell and the Samba Team 1992-2020
[2021/02/23 14:57:23.312207, 1] ../../source3/profile/profile.c:55(set_profile_level)
INFO: Profiling turned OFF from pid 2360
[2021/02/23 14:57:23.345139, 0] ipa_sam.c:3980(get_fallback_group_sid)
Missing mandatory attribute ipaNTSecurityIdentifier.
[2021/02/23 14:57:23.345184, 0] ipa_sam.c:4950(pdb_init_ipasam)
Cannot find SID of fallback group.
[2021/02/23 14:57:23.345194, 0] ../../source3/passdb/pdb_interface.c:180(make_pdb_method_name)
pdb backend ipasam:ldapi://%2fvar%2frun%2fslapd-TEST-IDM-COMPANY-COM.socket did not correctly init (error was NT_STATUS_INVALID_PARAMETER)
[2021/02/23 15:05:11.201577, 0] ../../source3/smbd/server.c:1782(main)
smbd version 4.12.3 started.
Copyright Andrew Tridgell and the Samba Team 1992-2020
[2021/02/23 15:05:11.212856, 1] ../../source3/profile/profile.c:55(set_profile_level)
INFO: Profiling turned OFF from pid 3146
[2021/02/23 15:05:11.234448, 0] ipa_sam.c:3980(get_fallback_group_sid)
Missing mandatory attribute ipaNTSecurityIdentifier.
A quick search suggests that potentially my change of the RID has affected SMB but I'm not 100% sure what to do next.
I guess I need to add an ipaNTSecurityIdentifier variable - but I'm not sure where.
This page https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/trust-i... suggests that I need to add a sidgen to the FreeIPA users that exist, but those users were created via the GUI - shouldn't the SID have been created then?
And if they didn't, how come I've been able to reboot successfully relatively frequently without this issue happening before - is it because I changed the value of that one domain's ID range?
Cheers
L.
2 years, 9 months