November 2023 - FreeIPA-users - Fedora mailing-lists

FreeIPA web session timeout
by Yuri Krysko 11 Jan '24

11 Jan '24

Hello, Could you please advise how to configure FreeIPA web UI user session timeout? Thanks, Yuri ________________________________ LEGAL DISCLAIMER: M.C. Dean, Inc. and its subsidiaries considers this e-mail and any files transmitted with it to be protected, proprietary or privileged information intended solely for the use of the named recipient(s). Any disclosure of this material or the information contained herein, in whole or in part, to anyone outside of the intended recipient or affiliates is strictly prohibited. M. C. Dean, Inc. accepts no liability for the content of this e-mail or for the consequences of any actions taken on the basis of the information contained in it, unless that information is subsequently confirmed in writing. Employees of M.C. Dean, Inc. are instructed not to infringe on any rights of the recipient; any such communication violates company policy. If you are not the intended recipient, any disclosure, copying, distribution, or action taken or omitted in reliance on this information is strictly prohibited by M.C. Dean, Inc.; please notify the sender immediately by return e-mail, delete this communication and destroy all copies.

4 4

Re: Issues with password based authentication on IPA
by Alexander Bokovoy 04 Dec '23

04 Dec '23

Please don't drop mailing list. On Аўт, 28 ліс 2023, Pradeep KNS wrote: >Hey Alexander, > >Thanks For the Reply. > >But in my case i have fixed it by recreating the user on Ipa web UI and >observing ipantuserattrs created password logins are working fine. > >But do I face any issues if I try to modify the base id range manually? as >per redhat docs which is not recommended to modify. If you have re-created your user and that new one works, it means underlying infrastructure works properly. Older user entries need to be fixed. Preferrably through a new ID range, if those entries use IDs which are outside of the main ID range. > >Also on ipa 4.11 they support dedicated ssh key based >authentication.Ofcourse now also its working. > >My setup is that I have internal dns which is handled by a puppet and >slowly will move it to a dedicated internal dns server so that's why i >opted for ipa installation without dns. > >On Tue, Nov 28, 2023 at 1:06 PM Alexander Bokovoy <abokovoy(a)redhat.com> >wrote: > >> On Пан, 27 ліс 2023, Pradeep KNS via FreeIPA-users wrote: >> >Hi Rob, >> >Thank you for your email. I've identified the issue. >> >When attempting to create a user using the 'ipa user-add' command and >> >defining the UID and GID according to my specifications, the UID falls >> >within the 4-digit range, for instance, 4141. The >> >IPA IDs range during installation was set to 770000. Users created within >> >this range are accepted with their passwords. However, users created with >> >UIDs like 4141 or 4142 encounter issues. >> > >> >Looks like attributes, were not creating >> > >> >objectclass: top, person, organizationalperson, inetorgperson, inetuser, >> >posixaccount, krbprincipalaux, krbticketpolicyaux, ipaobject, ipasshuser, >> >ipaSshGroupOfPubKeys, mepOriginEntry, ipantuserattrs >> > >> >If i mention uid and gid using ipa user-add command >> >ipantuserattrs is not getting create. >> > >> >I tried to modify default range but it dint happened. >> >> See my answers in a parallel thread 'kinit fails on freeipa master: File >> or directory not found'. >> >> > >> > >> > >> >On Mon, 27 Nov 2023 at 9:41 PM, Rob Crittenden <rcritten(a)redhat.com> >> wrote: >> > >> >> Pradeep KNS wrote: >> >> > Hi, >> >> > I have installed an ipa with internal dns.After installing updated >> >> > entries on dns as well. >> >> > >> >> > My main criteria is to communicate with ipa clients with ssh keybased >> >> > authentication which is working fine. >> >> > >> >> > Today i tot of i want to test with password based authentication which >> >> > is not happening.I dont know where i am missing >> >> > >> >> > >> >> > [root(a)example.com <mailto:root@example.com>]# ipa --version >> >> > VERSION: 4.10.1, API_VERSION: 2.251 >> >> > [root(a)example.com <mailto:root@example.com>]# >> >> > >> >> > ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING >> >> > BACKTRACE: >> >> > * (2023-11-23 19:33:16): [krb5_child[11588]] [tgt_req_child] >> >> > (0x1000): [RID#15] Password was expired >> >> >> >> The user's password is expired. >> >> >> >> IPA intends that only the end-user knows their password. So if it is set >> >> or reset by an administrator the user will need to change it. >> >> >> >> Is the user not prompted to reset it? >> >> >> >> rob >> >> >> >> > * (2023-11-23 19:33:16): [krb5_child[11588]] [sss_krb5_responder] >> >> > (0x4000): [RID#15] Got question [password]. >> >> > * (2023-11-23 19:33:16): [krb5_child[11588]] [map_krb5_error] >> >> > (0x0020): [RID#15] 2138: [-1765328324][Generic error (see e-text)] >> >> > ********************** BACKTRACE DUMP ENDS HERE >> >> > ********************************* >> >> > >> >> > ssh log >> >> > >> >> > Nov 23 19:33:16 test-example.com <http://test-example.com> >> sshd[11586]: >> >> > pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 >> >> > tty=ssh ruser= rhost=10.10.1.1 user=harsh >> >> > Nov 23 19:33:16 test-example.com <http://test-example.com> >> sshd[11586]: >> >> > pam_sss(sshd:auth): received for user harsh: 4 (System error) >> >> > Nov 23 19:33:18test-example.com <http://18test-example.com> >> sshd[11584]: >> >> > error: PAM: Authentication failure for harsh from 10.10.1.1 >> >> > Nov 23 19:33:20 test-example.com <http://test-example.com> >> sshd[11584]: >> >> > Connection closed by authenticating user harsh 10.10.1.1 port 47724 >> >> > [preauth] >> >> >> >> >> >> >> >> >> >> >> -- >> / Alexander Bokovoy >> Sr. Principal Software Engineer >> Security / Identity Management Engineering >> Red Hat Limited, Finland >> >> -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

2 13

Auto cleanup old enrolled hosts
by Russ Long 01 Dec '23

01 Dec '23

We're adding FreeIPA to an immutable, often rotated environment (AWS ECS Hosts). These hosts are spun up and down at least daily. Is there a way to check FreeIPA to see when a host has last communicated with the FreeIPA Cluster? I'd like to use this information to auto-delete hosts that have not reported in from the FreeIPA host list.

5 4

SELinux is preventing generating SID on RHEL9
by Michal Konecny 30 Nov '23

30 Nov '23

Hi, I upgraded Fedora staging environment to RHEL 9 and encountered this issue https://access.redhat.com/solutions/7015184. To resolve that I tried to run `ipa config-mod --enable-sid --add-sids`, but it failed on `The ipa-enable-sid command failed, exception: PermissionError: [Errno 13] Permission denied: '/etc/krb5.conf.ipabkp'` As expected this was SELinux issue ``` type=AVC msg=audit(1701349641.295:30008): avc: denied { write } for pid=157909 comm="org.freeipa.ser" name="etc" dev="dm-0" ino=33685633 scontext=system_u:system_r:ipa_helper_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0 ``` I tried to relabel the whole system to fix it, but the denial is still there. Did I miss something? Shouldn't IPA server had access to /etc? Michal

2 6

Re: Cannot import certificate signed by MS-CA - subject mismatch
by Abhinay Reddy 30 Nov '23

30 Nov '23

Hello Fraser, Can we change it to UTF-8 on RHEL using openssl after the certificate is received from AD ? Just checking if that possible ?

1 0

certgmonger not able to renew a certificate: 2100 (Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty)).
by Sam Morris 28 Nov '23

28 Nov '23

Hi folks, I've got a machine where certmonger is unable to renew a certificate request: # getcert list -i 20220519165212 Number of certificates and requests being tracked: 2. Request ID '20220519165212': status: MONITORING ca-error: Server at https://ipa5.ipa.example.com/ipa/json denied our request, giving up: 2100 (Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty)). stuck: no key pair storage: type=FILE,location='/etc/cockpit/ws-certs.d/51-xoanon.key' certificate: type=FILE,location='/etc/cockpit/ws-certs.d/51-xoanon.crt' CA: IPA issuer: CN=Certificate Authority,O=IPA.EXAMPLE.COM subject: CN=xoanon.ipa.example.com,O=IPA.EXAMPLE.COM issued: 2023-06-21 07:49:49 UTC expires: 2023-09-19 07:49:49 UTC dns: xoanon.ipa.example.com principal name: host/xoanon.ipa.example.com(a)IPA.EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes I'm manually attempting to renew the certificate with: [root@xoanon ~]# getcert resubmit -w -v -i 20220519165212 Resubmitting "20220519165212" to "IPA". State GENERATING_CSR, stuck: no. State SUBMITTING, stuck: no. State MONITORING, stuck: no. On the server side, I'm unable to find any errors being logged anywhere. Even after I set 'debug = true' in /etc/ipa/default.conf & restarted httpd.service, the only log messages are: ==> /var/log/httpd/error_log <== [Wed Aug 23 10:59:50.765980 2023] [wsgi:error] [pid 124570:tid 140295030843136] [remote 192.168.88.3:52224] ipa: DEBUG: WSGI wsgi_dispatch.__call__: [Wed Aug 23 10:59:50.766232 2023] [wsgi:error] [pid 124570:tid 140295030843136] [remote 192.168.88.3:52224] ipa: DEBUG: WSGI jsonserver.__call__: [Wed Aug 23 10:59:50.766352 2023] [wsgi:error] [pid 124570:tid 140295030843136] [remote 192.168.88.3:52224] ipa: DEBUG: KerberosWSGIExecutioner.__call__: ==> /var/log/httpd/access_log <== 192.168.88.3 - host/xoanon.ipa.example.com(a)IPA.EXAMPLE.COM [23/Aug/2023:10:59:50 +0000] "POST /ipa/json HTTP/1.1" 200 526 ... which show that the API call was successful. On the other hand, according to 'ipa cert-find --subject=xoanon.ipa.example.com', no certificates have been issued. It looks like the API isn't calling out to PKI/Dogtag, since nothing is logged to /var/log/pki/pki-tomcat/localhost_access_log.*.txt or /var/log/pki/pki-tomcat/ca/debug.*.log. I also looked for AVC denials and didn't see anything in /var/log/audit. So, back to the client. certmonger logs the following: 2023-08-23 11:15:50 [834693] Wrote to /var/lib/certmonger/requests/20220519165212 2023-08-23 11:15:50 [834693] Wrote to /var/lib/certmonger/requests/20220519165212 2023-08-23 11:15:50 [834693] Wrote to /var/lib/certmonger/requests/20220519165212 2023-08-23 11:15:50 [834693] Wrote to /var/lib/certmonger/requests/20220519165212 2023-08-23 11:15:50 [834693] Wrote to /var/lib/certmonger/requests/20220519165212 2023-08-23 11:15:50 [834693] Wrote to /var/lib/certmonger/requests/20220519165212 2023-08-23 11:15:50 [834693] Wrote to /var/lib/certmonger/requests/20220519165212 2023-08-23 11:15:50 [834693] Wrote to /var/lib/certmonger/requests/20220519165212 2023-08-23 11:15:50 [836073] Setting "CERTMONGER_REQ_SUBJECT" to "CN=xoanon.ipa.example.com" for child. 2023-08-23 11:15:50 [836073] Setting "CERTMONGER_REQ_HOSTNAME" to "xoanon.ipa.example.com" for child. 2023-08-23 11:15:50 [836073] Setting "CERTMONGER_REQ_PRINCIPAL" to "host/xoanon.ipa.example.com(a)IPA.EXAMPLE.COM" for child. 2023-08-23 11:15:50 [836073] Setting "CERTMONGER_OPERATION" to "SUBMIT" for child. 2023-08-23 11:15:50 [836073] Setting "CERTMONGER_CSR" to "-----BEGIN CERTIFICATE REQUEST----- MIIEpzCCAw8CAQAwIzEhMB8GA1UEAxMYeG9hbm9uLmlwYS5yb2JvdHMub3JnLnVr [...] 4d6BlUMScGAgCAxfxEb1eXymTxVm/Do/liHaOqnHGVIr+1OjZNftrUODFQ== -----END CERTIFICATE REQUEST----- " for child. 2023-08-23 11:15:50 [836073] Setting "CERTMONGER_SPKAC" to "[...]" for child. 2023-08-23 11:15:50 [836073] Setting "CERTMONGER_SPKI" to "[...]" for child. 2023-08-23 11:15:50 [836073] Setting "CERTMONGER_LOCAL_CA_DIR" to "/var/lib/certmonger/local" for child. 2023-08-23 11:15:50 [836073] Setting "CERTMONGER_KEY_TYPE" to "RSA" for child. 2023-08-23 11:15:50 [836073] Setting "CERTMONGER_CA_NICKNAME" to "IPA" for child. 2023-08-23 11:15:50 [836073] Setting "CERTMONGER_CERTIFICATE" to "-----BEGIN CERTIFICATE----- MIIFajCCBFKgAwIBAgIET/8AJDANBgkqhkiG9w0BAQsFADA8MRowGAYDVQQKDBFJ [...] dF6L+2tIIpjYylCxKQISWaexKkv1jVQaIPB1foIKyLGaf9YtyaIwyoM9G80UaQ== -----END CERTIFICATE----- " for child. 2023-08-23 11:15:50 [836073] Redirecting stdin to /dev/null, leaving stdout and stderr open for child "/usr/libexec/certmonger/ipa-submit". 2023-08-23 11:15:50 [836073] Running enrollment helper "/usr/libexec/certmonger/ipa-submit". 2023-08-23 11:15:50 [834693] Wrote to /var/lib/certmonger/requests/20220519165212 Submitting request to "https://ipa5.ipa.example.com/ipa/json". JSON-RPC error: 2100: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) 2023-08-23 11:15:50 [834693] Certificate submission still ongoing. 2023-08-23 11:15:50 [834693] Certificate submission attempt complete. 2023-08-23 11:15:50 [834693] Child status = 2. 2023-08-23 11:15:50 [834693] Child output: "Server at https://ipa5.ipa.example.com/ipa/json denied our request, giving up: 2100 (Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty)). " 2023-08-23 11:15:50 [834693] Server at https://ipa5.ipa.example.com/ipa/json denied our request, giving up: 2100 (Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty)). 2023-08-23 11:15:50 [834693] Certificate not (yet?) issued. 2023-08-23 11:15:50 [834693] Wrote to /var/lib/certmonger/requests/20220519165212 I found that I could add 'OPTS=-d9' to /etc/sysconfig/certmonger & restart certmonger.service, which does cause it to log more, but it doesn't give any further insight into the messages exchanged with the server. Does anyone know where I can look next? -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

3 13

Password policy by ip
by Francis Augusto Medeiros-Logeay 28 Nov '23

28 Nov '23

Hi, I recently started to use FreeIPA for ldap login for my mail server (dovecot). I wonder if it is possible to disable user locking when fail requests come from dovecot. That’s because it already has fail2ban enabled there, and I feel that it should block logins from a particular ip, not user login per se. At the same time, I’d like to keep user lock for the other logins. Is this doable? Best, Francis

3 6

Issues with password based authentication on IPA
by Pradeep KNS 28 Nov '23

28 Nov '23

Hi, I have installed an ipa with internal dns.After installing updated entries on dns as well. My main criteria is to communicate with ipa clients with ssh keybased authentication which is working fine. Today i tot of i want to test with password based authentication which is not happening.I dont know where i am missing [root(a)example.com]# ipa --version VERSION: 4.10.1, API_VERSION: 2.251 [root(a)example.com]# ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2023-11-23 19:33:16): [krb5_child[11588]] [tgt_req_child] (0x1000): [RID#15] Password was expired * (2023-11-23 19:33:16): [krb5_child[11588]] [sss_krb5_responder] (0x4000): [RID#15] Got question [password]. * (2023-11-23 19:33:16): [krb5_child[11588]] [map_krb5_error] (0x0020): [RID#15] 2138: [-1765328324][Generic error (see e-text)] ********************** BACKTRACE DUMP ENDS HERE ********************************* ssh log Nov 23 19:33:16 test-example.com sshd[11586]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.10.1.1 user=harsh Nov 23 19:33:16 test-example.com sshd[11586]: pam_sss(sshd:auth): received for user harsh: 4 (System error) Nov 23 19:33:18test-example.com sshd[11584]: error: PAM: Authentication failure for harsh from 10.10.1.1 Nov 23 19:33:20 test-example.com sshd[11584]: Connection closed by authenticating user harsh 10.10.1.1 port 47724 [preauth]

3 3

kinit fails on freeipa master: File or directory not found
by David Leeuwestein 28 Nov '23

28 Nov '23

Dear IPA users, I need your help on an issue. An upgrade from Fedora 36 to Fedora 38 has completely broken Kerberos authentication in our Freeipa realm. kinit <username> fails for every user but our domain admin. Hosts can't authenticate themselves, too. Everything works fine if I add disable_pac = true in the /etc/krb5.conf. However, this isn't a recommended setting from a security point of view. Therefore, we can't accept that as a workaround. I found several posts suggesting generating sids for the users. So I did that by calling ipa config-mod --enable-sid --add-sids. The job run without any error and assigned a sid to each user. I confirmed this with ipa user show --all. I also verified that the firewall configuration matches the recommondations of freeipa: https://www.freeipa.org/page/Active_Directory_trust_setup#iptables I also thought this issue could be caused by a Freeipa version mismatch between our two master servers. Therefore, I updated both servers to Fedora 38, but the problem still exists. I tried to collect the vital system information. $ kinit user Passwort für user(a)INTERN.EXAMPLE.DE: kinit: allgemeiner Fehler (siehe E-Text) bei Anfängliche Anmeldedaten werden geholt. the `/var/log/krb5kdc.log` contains the following entries for an authentication attempt: Nov 25 20:22:35 id.intern.example.de krb5kdc[2858](Information): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha256-128(19), aes128-cts-hmac-sha1-96(17), camellia128-cts-cmac(25)}) 141.83.153.180: HANDLE_AUTHDATA: user(a)INTERN.EXAMPLE.DE für krbtgt/INTERN.EXAMPLE.DE(a)INTERN.EXAMPLE.DE, Datei oder Verzeichnis nicht gefunden The content of our `/etc/krb5.conf` is: includedir /etc/krb5.conf.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = INTERN.EXAMPLE.DE dns_lookup_realm = false dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} [realms] INTERN.EXAMPLE.DE = { kdc = id.intern.example.de:88 master_kdc = id.intern.example.de:88 kpasswd_server = id.intern.example.de:464 admin_server = id.intern.example.de:749 default_domain = intern.example.de pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem } [domain_realm] .intern.example.de = INTERN.EXAMPLE.DE intern.example.de = INTERN.EXAMPLE.DE id.intern.example.de = INTERN.EXAMPLE.DE [dbmodules] INTERN.EXAMPLE.DE = { db_library = ipadb.so } [plugins] certauth = { module = ipakdb:kdb/ipadb.so enable_only = ipakdb } IPA diagnostics show no error: $ ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful I also asked this question on serverfault: https://serverfault.com/posts/1148566 Please let me know, if I forgot to include anything vital. I never posted to a user mailing list before. Please let me know if I failed to follow a best practice. I'd appreciate any help since I am stuck here. Have a nice day! David Leeuwestein

2 4

Diff between giving User direct membership vs a User Group to a Posix or NON-Posix User Group?
by Finn Fysj 27 Nov '23

27 Nov '23

I have a running IPA server which has both POSIX and NON-POSIX User Groups. However, I'm not using FreeIPA in a classic manner, mostly just as a LDAP server with GUI making it easier for end users to manage their stuff. I'm curious if there's a difference between Users or Users Groups when assigning these to a POSIX or NON-POSIX user group? E.g A user was not able to SSH into a machine because the user couldn't be found as a member of the group: $ getent group test-group test-group:*:5010: In the example above, I have attached memebership to another User Group: end_users --> test-group. However, if give a user in end_users direct access to the test-group, they can successfully SSH and they're shown in the getent command: $ getent group test-group test-group:*:5010:userX Of course, with NON-POSIX group I'm not able to run any commands, but I haven't had any problems when I

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2023