January 2022 - FreeIPA-users - Fedora mailing-lists

FreeIPA and Certbot ?
by Günther J. Niederwimmer 05 Jan '22

05 Jan '22

Hello list, Why are there actually problems between FreeIPA and Certbot? What I have found out so far is it no longer possible to install FreeIPA as a client and replication server if Certbot is installed before ipa-client- install? The question now is, are there also problems when Certbot is installed after FreeIPA? Can I still use Lestencryt at all? Thanks for an answer, -- mit freundlichen Grüßen / best regards Günther J. Niederwimmer

3 3

2 conflict entries found under the replication suffix o=ipaca - ? - issue
by lejeczek 05 Jan '22

05 Jan '22

Hi guys. -> $ ipa-healthcheck .. { "source": "ipahealthcheck.ds.replication", "check": "ReplicationCheck", "result": "WARNING", "uuid": "7ff8f869-36c8-411c-9c44-7cb323deaf95", "when": "20220104193941Z", "duration": "0.574693", "kw": { "key": "DSREPLLE0002", "items": [ "Replication", "Conflict Entries" ], "msg": "There were 2 conflict entries found under the replication suffix \"o=ipaca\"." } I have found some old tips here from the list but I'm not sure what to do with it. -> $ ldapsearch -H ldaps://$(hostname) -W -D 'cn=Directory Manager' -b 'o=ipaca' '(&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))' nsds5ReplConflict Enter LDAP Password: # extended LDIF # # LDAPv3 # base <o=ipaca> with scope subtree # filter: (&(objectClass=ldapSubEntry)(nsds5ReplConflict=*)) # requesting: nsds5ReplConflict # # 7c395f01-6d6211ec-a624dc4c-7402d017 + admin-dzien.mine.private, people, ipaca dn: nsuniqueid=7c395f01-6d6211ec-a624dc4c-7402d017+uid=admin-dzien.mine.privat e,ou=people,o=ipaca nsds5ReplConflict: namingConflict (ADD) uid=admin-dzien.mine.private,ou=people ,o=ipaca # e6ed9901-6d6811ec-affe8b51-4855b2e0 + admin-swir.mine.private, people, ipaca dn: nsuniqueid=e6ed9901-6d6811ec-affe8b51-4855b2e0+uid=admin-swir.mine.private ,ou=people,o=ipaca nsds5ReplConflict: namingConflict (ADD) uid=admin-swir.mine.private,ou=people, o=ipaca Remove either entries? many thanks, L.

2 5

Re: SSL error after upgrade
by Per Qvindesland 05 Jan '22

05 Jan '22

Hi ScottMany thanks for the information and apologies for the delay in responding.I folllowed the information and it's all working now.RegardsPerOn 25 Dec 2021, at 17:06, "Dungan, Scott A. via FreeIPA-users" <freeipa-users(a)lists.fedorahosted.org> wrote:Hi, Per. I ran into the same problem and Alexander referred me to this link: https://www.mail-archive.com/freeipa-users@lists.fedorahosted.org/msg12583.… fix for us was is pretty easy: Make a backup of /etc/pki/pki-tomcat/server.xmlOn lines 129 and 171 of server.xml, you’ll see a value for “secret=” and “sharedSecret=.” Those values will be different and that is the cause of the problem. Both values should match what is found in the ProxyPassMatch statements located in the file /etc/httpd/conf.d/ipa-pki-proxy.conf. In my case, the value for secret= was correct and I just had to change the sharedSecert= to match.Restart services with ipactl restart -Scott From: Per Qvindesland via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Sent: Wednesday, December 22, 2021 7:22 AM To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Per Qvindesland <perq(a)icloud.com> Subject: [Freeipa-users] SSL error after upgrade Hi All After an update to 4.9.6-10, I am unable to view any of the certificates that the IPA server has signed, I get error: An error has occurred (IPA Error 4301: CertificateOperationError) when I click on Authnticaiton -> Certificates, if I click on "Certificate Autorities" then I get popup message with the error "Failed to authenticate to CA REST API" and "An error has occurred (IPA Error 4016: RemoteRetrieveError)" is showing on the screen. ipactl status is showing everything as running:ipactl statusDirectory Service: RUNNINGkrb5kdc Service: RUNNINGkadmin Service: RUNNINGnamed Service: RUNNINGhttpd Service: RUNNINGipa-custodia Service: RUNNINGpki-tomcatd Service: RUNNINGsmb Service: RUNNINGwinbind Service: RUNNINGipa-otpd Service: RUNNINGipa-dnskeysyncd Service: RUNNINGipa: INFO: The ipactl command was successful Does anyone know what's causing this error? I ran ipa-healthcheck and pasted the output below, it reports that it's missing SRV records but the IPA server is the DNS server and it has the SRV records. RegardsPer ipa-healthcheckra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)[ { "source": "ipahealthcheck.dogtag.ca", "check": "DogtagCertsConnectivityCheck", "result": "ERROR", "uuid": "ac0200eb-3ec8-405f-ba5e-523cbb40ad6b", "when": "20211222151125Z", "duration": "0.016156", "kw": { "msg": "Request for certificate failed, Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "2f010c35-7d7d-431f-89b0-c342516cf296", "when": "20211222151130Z", "duration": "0.412221", "kw": { "key": "20211104170633", "serial": 7, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "10a946e2-e511-417a-b189-a66f1b555470", "when": "20211222151130Z", "duration": "0.519989", "kw": { "key": "20211104170628", "serial": 5, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "7c85e383-8508-4b8e-a10b-838b0b70eb73", "when": "20211222151130Z", "duration": "0.618106", "kw": { "key": "20211104170629", "serial": 2, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "1776678c-d997-435b-b809-52576128a2e9", "when": "20211222151130Z", "duration": "0.709013", "kw": { "key": "20211104170630", "serial": 4, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "f02ff5d9-13cf-4582-9bd3-7567b32c415d", "when": "20211222151130Z", "duration": "0.789825", "kw": { "key": "20211104170631", "serial": 1, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "d30b17b3-f45e-4317-bf8e-c1c13c3f77e3", "when": "20211222151131Z", "duration": "0.903311", "kw": { "key": "20211104170632", "serial": 3, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "32ff9bb7-69b8-4af3-8c20-9f2ab4394a73", "when": "20211222151131Z", "duration": "0.969296", "kw": { "key": "20211104170635", "serial": 34, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "18fb96f0-7a64-4c1c-b03b-bb21e3f90bf1", "when": "20211222151131Z", "duration": "1.065584", "kw": { "key": "20211104170634", "serial": 8, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "d82cdf6d-4d4b-44e4-9aa8-33211aa55c96", "when": "20211222151131Z", "duration": "1.116597", "kw": { "key": "20210811074531", "serial": 10, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "cc0c7d5c-1132-4b18-ac8e-c7625d3963f0", "when": "20211222151131Z", "duration": "0.015692", "kw": { "msg": "Expected SRV record missing", "key": "_ldap._tcp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "f0d6873f-b681-457d-8006-9e5bb051b9df", "when": "20211222151131Z", "duration": "0.017296", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._tcp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "92a5517d-5f73-4f49-8874-bf6bbeb2ed9d", "when": "20211222151131Z", "duration": "0.018275", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._udp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "7f1994fb-e1dc-4d8c-93c5-5ba2e6652427", "when": "20211222151131Z", "duration": "0.019243", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos-master._tcp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "e9bbd202-8f37-4a44-b9b0-377ae5a53d08", "when": "20211222151131Z", "duration": "0.020150", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos-master._udp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "2d4a438f-6271-470e-a6f5-68a30858d928", "when": "20211222151131Z", "duration": "0.021502", "kw": { "msg": "Expected SRV record missing", "key": "_kpasswd._tcp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "828efbaf-2071-4693-94f4-0e4c2ec884c0", "when": "20211222151131Z", "duration": "0.022772", "kw": { "msg": "Expected SRV record missing", "key": "_kpasswd._udp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "b0a73e45-da65-43a6-a540-8e092e3e4d76", "when": "20211222151131Z", "duration": "0.023895", "kw": { "msg": "Expected SRV record missing", "key": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.proxdynamics.com.:ldap2…." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "3329eea5-c794-4201-a973-82f22b58f151", "when": "20211222151131Z", "duration": "0.025341", "kw": { "msg": "Expected SRV record missing", "key": "_ldap._tcp.dc._msdcs.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "dde9dd12-e044-4bde-a75f-2ea4d96910dc", "when": "20211222151131Z", "duration": "0.027364", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.proxdynamics.com.:l…." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "9ebec84f-aa7d-4ba9-8c4e-ca8dd2aa98c8", "when": "20211222151131Z", "duration": "0.029421", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._udp.Default-First-Site-Name._sites.dc._msdcs.proxdynamics.com.:l…." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "cd921441-98bf-4fc1-a043-ed35a056e818", "when": "20211222151131Z", "duration": "0.030800", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._tcp.dc._msdcs.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "93f21c35-a10d-418b-a549-c0c70d6330cd", "when": "20211222151131Z", "duration": "0.031808", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._udp.dc._msdcs.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "331ef74f-e5d6-47d8-a666-a352320772de", "when": "20211222151131Z", "duration": "0.034319", "kw": { "msg": "Got {count} ipa-ca A records, expected {expected}", "count": 0, "expected": 1 } }] _______________________________________________FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.orgTo unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.orgFedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelinesList Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

1 0

allowing password only one place
by Charles Hedrick 04 Jan '22

04 Jan '22

We have users who have otp set. I want to require them to use it except in one specific situation, where I want to be able to use a keytable to generate credentials for them (which have to work for all services). Can anyone think of a way to do this? Auth indicators doesn't seem to do the job, since it looks like a constraint on using the ticket, where I'm concerned with how it's generated. The only thing I've come up with is setting the directory server to override ipaUserAuthType for that host. There's got to be a better way.

1 0

listing current KCM ccaches
by Charles Hedrick 04 Jan '22

04 Jan '22

I'm trying to find ways to get rid of as much of my custom C coding as possible, since I may be the only one that can maintain it. One major one is renewd, which renews tgt's automatically. sssd can now do this. However I also need to kill the tickets when the user is no longer active. This could be done in a fairly simple shell script, but only if I can find a list of current active credential caches. At the moment the only way I can see to do that is to use tdbdump on secrets.ldb. I'm probably going to try that, but I'd prefer a better approach.

1 0

Replica install fails due nonexisting RID ranges
by Andrius Jurkus 03 Jan '22

03 Jan '22

Hello, I didint enable adrust or installed related packages, I dont use samba shares either on existing installation. I wanted to create additional replica, during install it asked what is NETBIOS name and if I want to generate SID identifiers for users (answered no) then process failed with errors below. Should I update my ID ranges? or there is replica install option to skip this setup. (I dont use cross AD trusts, or similar features) Configuring SID generation [1/7]: creating samba domain object Samba domain object already exists [2/7]: adding admin(group) SIDs Admin SID already set, nothing to do Admin group SID already set, nothing to do [3/7]: adding RID bases Found more than one local domain ID range with no RID base set. [error] RuntimeError: Too many ID ranges Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. Too many ID ranges 2021-12-27T17:56:04Z DEBUG [2/7]: adding admin(group) SIDs 2021-12-27T17:56:04Z DEBUG Admin SID already set, nothing to do 2021-12-27T17:56:04Z DEBUG Admin group SID already set, nothing to do 2021-12-27T17:56:04Z DEBUG step duration: SID generation __add_admin_sids 0.00 sec 2021-12-27T17:56:04Z DEBUG [3/7]: adding RID bases 2021-12-27T17:56:04Z CRITICAL Found more than one local domain ID range with no RID base set. 2021-12-27T17:56:04Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 635, in start_creation run_step(full_msg, method) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 621, in run_step method() File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 380, in __add_rid_bases raise RuntimeError("Too many ID ranges\n") RuntimeError: Too many ID ranges 2021-12-27T17:56:04Z DEBUG [error] RuntimeError: Too many ID ranges 2021-12-27T17:56:04Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 180, in execute return_value = self.run() File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 342, in run return cfgr.run() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 655, in _configure next(executor) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.6/site-packages/ipaserver/install/server/__init__.py", line 603, in main replica_install(self) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 401, in decorated func(installer) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 1371, in install adtrust.install(False, options, fstore, api) File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrust.py", line 483, in install smb.create_instance() File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 895, in create_instance self.start_creation(show_service_name=False) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 635, in start_creation run_step(full_msg, method) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 621, in run_step method() File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 380, in __add_rid_bases raise RuntimeError("Too many ID ranges\n") 2021-12-27T17:56:04Z DEBUG The ipa-replica-install command failed, exception: RuntimeError: Too many ID ranges 2021-12-27T17:56:04Z ERROR Too many ID ranges

2 2

[pam] [sss_dp_on_reconnect] (0x0010): Could not reconnect to provider.
by Alexander Becker 03 Jan '22

03 Jan '22

Hello all, since some time we have some cases where a sssd login does not work anymore and a service restart is necessary. According to analysis, there is a high disk and CPU usage at that time. Affected are clients with Ubuntu 20.04 sssd 2.2.3 freeipa 4.8.6 We get the following error messages: sssd_pam.log [pam] [sss_dp_on_reconnect] (0x0010): Could not reconnect to ad.server provider. auth.log pam_sss(sshd:account): Access denied for user monitor: 4 (System error) sshd[3126935]: fatal: Access denied for user monitor by PAM account configuration [preauth]. Does anyone have any ideas?

2 1

2FA - prompting - single_prompt
by Winfried de Heiden 03 Jan '22

03 Jan '22

Hi all, Using FreeIPA, 2FA can be made optional by enabling "Password" AND "Two factor authentication (password + OTP)" for a user. For particular hosts the 2FA now can be made mandatory by enabling "Two factor authentication (password + OTP)" Now, for hosts for which 2FA is NOT mandatory, according to the man pages, 2FA can be made "invissible" by using the "single_prompt" option. In man sssd.conf: "If the second factor is optional and it should be possible to log in either only with the password or with both factors two-step prompting has to be used." However, this doesn't work. When using the "single_prompt" login will fail. Using two prompts, and just press enter for the second 2FA prompt, login will succeed. Hence: did I forget something or is there a bug involved? FYI: tested on CentOS Stream9 -- email handtekening privé Met vriendelijke groet, Winfried de Heiden wdh(a)dds.nl

2 1

ipa-ca-install rejects confirmed correct DM password
by Chris Candreva 03 Jan '22

03 Jan '22

My problem is what the subject says. Most of the searches I've found are what to do when you don't know the Directory Manager password. However I can confirm it is correct with ldapsearch, yet ipa-ca-install says it is wrong. I'd appreciate any hints as to where to look next. [root@ipa3 chris]# export DMP=<pasword> [root@ipa3 chris]# ldapsearch -x -D "cn=directory manager" -w $DMP -s base -b "" "objectclass=*" | head # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: objectclass=* # requesting: ALL # # dn: [root@ipa3 chris]# ipa-ca-install --password=$DMP Directory Manager password is invalid -- --- ======================================================================== Chris Candreva -- chris(a)westnet.com -- http://www.westnet.com/~chris

2 1

Samba 4.10.16-17.el7_9 and IPA 4.6.8-5.el7.centos.10 updates broke SMB Kerberos authentication
by Konstantin M. Khankin 01 Jan '22

01 Jan '22

Hello! I have several SMB shares served by Samba using Kerberos accounts managed by FreeIPA. I have no AD integrations and no AD itself. Windows clients are configured using this <https://www.freeipa.org/page/Windows_authentication_against_FreeIPA> guide, linux clients use ipa-client and "smbclient -k". Servers and linux clients use CentOS 7. Today I received updates for ipa-* (to 4.6.8-5.el7.centos.*10* from 4.6.8-5.el7.centos.*9*) and samba-* (to 4.10.16-*17*.el7_9 from 4.10.16-*15*.el7_9) packages and authentication broke, no clients can connect to shares anymore. Here are logs from linux client: $ klist Ticket cache: KEYRING:persistent:1696200001:1696200001 Default principal: me(a)MYDOMAIN.LOC Valid starting Expires Service principal 12/30/2021 18:04:03 12/31/2021 18:03:46 cifs/samba.server.mydomain.loc(a)MYDOMAIN.LOC 12/30/2021 18:04:02 12/31/2021 18:03:46 nfs/samba.server.mydomain.loc(a)MYDOMAIN.LOC 12/30/2021 18:03:49 12/31/2021 18:03:46 krbtgt/MYDOMAIN.LOC(a)MYDOMAIN.LOC $ smbclient -k -L //samba.server.mydomain.loc session setup failed: NT_STATUS_NO_IMPERSONATION_TOKEN Server logs: *log.smbd:* [2021/12/30 19:03:23.597495, 2] ../../source3/lib/smbldap.c:847(smbldap_open_connection) smbldap_open_connection: connection opened [2021/12/30 19:03:23.695598, 3] ../../source3/lib/smbldap.c:1069(smbldap_connect_system) ldap_connect_system: successful connection to the LDAP server [2021/12/30 19:03:23.737401, 1] ipa_sam.c:4896(pdb_init_ipasam) pdb_init_ipasam: support for pdb_enum_upn_suffixes enabled for domain mydomain.loc [2021/12/30 19:03:23.737597, 3] ../../lib/util/access.c:365(allow_access) Allowed connection from 192.168.10.1 (192.168.10.1) *log.192.168.10.1:* ... [2021/12/30 19:05:22.458992, 3] ../../source3/smbd/negprot.c:776(reply_negprot) Selected protocol SMB 2.??? [2021/12/30 19:05:22.459495, 3] ../../source3/smbd/smb2_negprot.c:293(smbd_smb2_request_process_negprot) Selected protocol SMB3_11 [2021/12/30 19:05:22.524677, 3] ../../auth/kerberos/gssapi_pac.c:123(gssapi_obtain_pac_blob) gssapi_obtain_pac_blob: obtaining PAC via GSSAPI gss_get_name_attribute failed: The operation or option is not available or unsupported: No such file or directory [2021/12/30 19:05:22.524750, 1] ../../auth/gensec/gensec_util.c:70(gensec_generate_session_info_pac) gensec_generate_session_info_pac: Unable to find PAC in ticket from me(a)MYDOMAIN.LOC, failing to allow access [2021/12/30 19:05:22.524784, 3] ../../source3/smbd/smb2_server.c:3213(smbd_smb2_request_error_ex) smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] status[NT_STATUS_NO_IMPERSONATION_TOKEN] || at ../../source3/smbd/smb2_sesssetup.c:146 [2021/12/30 19:05:22.525565, 3] ../../source3/smbd/server_exit.c:236(exit_server_common) Server exit (NT_STATUS_END_OF_FILE) Googling, source-digging and "log level = 5" were not helpful. However, I find changelogs somewhat interesting: $ rpm -q --changelog ipa-server | head * Thu Dec 16 2021 CentOS Sources <bugs(a)centos.org> - 4.6.8-5.el7.centos.10 - Roll in CentOS Branding * Thu Dec 02 2021 Florence Blanc-Renaud <frenaud(a)redhat.com> - 4.6.8-5.el7_9.10 - Resolves: 2025848 - RHEL 8.6 IPA Replica Failed to configure PKINIT setup against a RHEL 7.9 IPA server - Fix cert_request for KDC cert - Resolves: 2021444 - CVE-2020-25719 ipa: samba: *Samba AD DC did not always rely on the SID and PAC in Kerberos tickets* - SMB: switch IPA domain controller role $ rpm -q --changelog samba | head * Mon Nov 15 2021 Andreas Schneider <asn(a)redhat.com> - 4.10.16-17 - related: #2019673 - *Add missing checks for IPA DC server role* * Mon Nov 08 2021 Andreas Schneider <asn(a)redhat.com> - 4.10.16-16 - resolves: #2019661 - Fix CVE-2016-2124 - resolves: #2019673 - Fix CVE-2020-25717 - resolves: #2021428 - *Add missing PAC buffer types to krb5pac.idl* I don't have access to the mentioned bugs in Bugzilla unfortunately. Maybe someone knows if I need to do something after upgrading these packages? Rolling back samba packages is unwanted given that Samba sources mention this is unsafe. Thanks! -- Konstantin Khankin

2 5

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2022