keytab file deleted and sssd not starting
by Jeremy Tourville
I don't know how but somehow /etc/krb5.keytab was deleted on my ipa server. As a result my sssd service is dead because the keytab file is missing
I understand the process to fix this is:
1. kinit admin and provide the password
2. ipa-getkeytab -s <FreeIPA server> -p host/<hostname>@REALM -k <keytab file>.
if command #2 is successful you should get a keytab file and you can run systemctl restart sssd and all will be happy again.
My problem is that when running command #2 I get an error if I specify -p host/ for the service prinicpal.
SASL bind failed
invalid credentials
failed to bind to server
Retrying with pre-4.0 keytab retrieval method...
If I specify -p ldap/ I can get it to complete and a keytab gets generated.
As a side note I have a bunch of ipa-healthcheck erors but maybe those are mostly related to the fact that sssd is not running and keytab is missing.
The affected server is my primary but I do have a replica that is in good heatlh except for one healthcheck issue for dns.
Both servers contain the following roles:
AD trust agent
AD trust controller
CA server
DNS server
The IPA server also has a one way trust established with AD.
What is the correct principal to specify? Is it host or ldap or dns or something else?
1 year, 1 month
Using "reserved" addresses inj Freeipa (200::/7)
by Dirk Gottschalk
Hello,
we want to use FreeIPA inside of a Yggdrasil-Network which uses the
0200::/7 address space. FreeIPA refuses to work with this addresses
because it detects them as IANA reserved address space.
Is there any way to override this behaviour and make it work in this
address space?
Kind Regards,
Dirk
1 year, 1 month
Authentication Kept Failing When SSHing to IPA Clients With The Right Password
by Loi Do
WHAT HAPPENED:
Hello all, I recently re-deployed FreeIPA server & clients due to an issue where an IPA created user wasn't able to SSH into their home directory (permission denied). There were several solutions that mentioned to run "authselect enable-feature with-mkhomedir" or "sudo authconfig --enablemkhomedir --update". At the time, none of these worked because a) authselect wasn't available on my system and I didn't think to install it b) authconfig was available but didn't work.
ISSUE:
I decided to redeploy the entire freeIPA deployment with "sudo ipa-server-install/ipa-client-install --mkhomedir" and now I can't authenticate to IPA clients with an IPA created user. I wasn't able to authenticate to the IPA server either until I spin up a new VM and reinstalled it.
As of now, I have an IPA server (vipa.homelab.internal - 192.168.254.198) and client (vpdns.homelab.internal - 192.168.254.33). I can authenticate the user "ldo" to vipa.homelab.internal via SSH but unable to do so for vpdns.homelab.internal.
RELATED THREAD:
I stumbled upon some old threads with users facing a similar issue but they weren't getting anywhere.
1. https://listman.redhat.com/archives/freeipa-users/2014-December/msg00197....
2. https://listman.redhat.com/archives/freeipa-users/2015-March/015895.html
3. https://listman.redhat.com/archives/freeipa-users/2015-March/016247.html
I believe the 1st link is the issue I might have (SSSD/PAM is somehow misconfigured). Others have pointed out that "sudo ipa-client-install/ipa-server-install --uninstall" is not a clean process which I believe might have caused some misconfiguration. I'm not familiar with SSSD/PAM on how they should be configured. I'm hoping this is where I can get help on.
Below are my SSH logs and /var/log/secure from vpdns.homelab.internal
SSH LOGS
[ldo@vipa ~]$ ssh -v ldo(a)vpdns.homelab.internal
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 62: Applying options for *
debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 22 vpdns.homelab.internal
debug1: permanently_drop_suid: 1860400001
debug1: key_load_public: No such file or directory
debug1: identity file /home/ldo/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ldo/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ldo/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ldo/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ldo/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ldo/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ldo/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ldo/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to vpdns.homelab.internal:22 as 'ldo'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305(a)openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305(a)openssh.com MAC: <implicit> compression: none
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:CmN1AtdcdqAbPxZNE8lEdpZSVOsBlzhel9cfHwS3j9M
debug1: Host 'vpdns.homelab.internal' is known and matches the ECDSA host key.
debug1: Found key in /home/ldo/.ssh/known_hosts:1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure. Minor code may provide more information
Server host/vpdns.homelab.internal(a)HOMELAB.INTERNAL not found in Kerberos database
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /home/ldo/.ssh/id_rsa
debug1: Trying private key: /home/ldo/.ssh/id_dsa
debug1: Trying private key: /home/ldo/.ssh/id_ecdsa
debug1: Trying private key: /home/ldo/.ssh/id_ed25519
debug1: Next authentication method: keyboard-interactive
Password:
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
Password:
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
Password:
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug1: Next authentication method: password
ldo(a)vpdns.homelab.internal's password:
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
Permission denied, please try again.
ldo(a)vpdns.homelab.internal's password:
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
Permission denied, please try again.
ldo(a)vpdns.homelab.internal's password:
Received disconnect from UNKNOWN port 65535:2: Too many authentication failures
Authentication failed.
/var/log/secure
Mar 20 15:24:39 vpdns sshd[9511]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.254.198 user=ldo
Mar 20 15:24:39 vpdns sshd[9511]: pam_sss(sshd:auth): received for user ldo: 7 (Authentication failure)
Mar 20 15:24:42 vpdns sshd[9509]: error: PAM: Authentication failure for ldo from 192.168.254.198
Mar 20 15:24:45 vpdns sshd[9514]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.254.198 user=ldo
Mar 20 15:24:45 vpdns sshd[9514]: pam_sss(sshd:auth): received for user ldo: 7 (Authentication failure)
Mar 20 15:24:47 vpdns sshd[9509]: error: PAM: Authentication failure for ldo from 192.168.254.198
Please let me know if I need to provide any additional information or logs. Do kindly specify where I can get them as well since I'm just starting out in Linux and FreeIPA. Thank you all in advance.
1 year, 1 month
Host based two factor requirements
by David Harvey
Hi there,
When I try and re-enable TOTP for a host auth indicator I receive
"invalid 'krbprincipalauthind': authentication indicators not allowed in
service "host""
Running FreeIPA 4.9.10 on Rocky.
I'm having some issues working out the current methods of OTP enforcement
for SSH interactive as a login method. I've had a look through
https://freeipa.readthedocs.io/en/latest/workshop/11-kerberos-ticket-poli...
but am still stuck.
I previously had a host configured (on its own details page) as requiring
password and otp as auth indicators. This was a little buggy in that the
GUI didn't display it after setting it, but did require an OTP on logging
in with SSH and was reflected byt the krbPrincipalAuthInd attr being set.
[image: image.png]
I cleared this for the host for $reasons - resulting in the attrs being
removed, and now if I try and re-enable I get:
[image: image.png]
Following that clue and those from other posts, I've been looking at the
services auth indicators as where to set instead, but as ssh or login don't
have services I can't work out how I am supposed to achieve this now?
Thanks in advance,
David
1 year, 1 month
Creating and modifying users from an external system
by Ronald Wimmer
We have several scenarios where we cannot establish an AD Trust. In
these cases we are forced to create/modify/delete IPA users triggered
from an IAM system. Is the IPA API the one and only way to go or would
it also work if we used IPA's LDAP directly?
Cheers,
Ronald
1 year, 1 month
access IPA client via ssh does not work
by cdth@gmx.net
I have a fresh IPA server setup with a trust to an Active Directory. Alls IPA services are working fine, IPA users can connect to IPA client hosts without problems.
I now have added an AD user via creating an ID override in the default trust view and added an ssh key for the user. I made the user a member of an IPA group which has access to the IPA client host (verified via IPA user which is a member of this group). I did this by --idoverrideusers= as --external= seems to be gone.
The AD user can't connect, not even that the ssh key is not working also the password does not work.
Running the HBAC test in the web UI gives an ACCESS DENIED for the AD user and an ACCESS GRANTED for the IPA user.
I also can see that a sssctl user-checks gives me a pam_acct_mgmt: Permission denied while for the IPA user it brings up pam_acct_mgmt: Success
The command id aduser(a)example.com lists the AD groups but I can't see the IPA group there.
Any hints will be greatly appreciated, thank you.
Best regards,
Thomas
1 year, 1 month
FreeIPA-Kubernetes Setup
by Ronald Wimmer
Hi,
are there any plans (or maybe ongoing work already) to let FreeIPA run
in a K8s environment?
Cheers,
Ronald
1 year, 1 month
backup & restore - 4.9.11 -> 4.10.1
by lejeczek
Hi guys.
I'm trying to migrate IPA from Centos 8 over to Centos 9 but
I fail.
If the path I try is supported & should work then, first,
'restore' failed with:
...
Restoring umask to 18
CalledProcessError(Command ['/usr/sbin/ipactl', 'start']
returned non-zero exit status 1: 'IPA version error: data
needs to be upgraded (expected version \'4.10.1-6.el9\',
current version
\'4.9.8-7.module_el8.6.0+1103+a004f6a8\')\nAutomatically
running upgrade, for details see /var/log/ipaupgrade.log\nBe
patient, this may take a few minutes.\nAutomatic upgrade
failed: Error caught updating nsDS5ReplicatedAttributeList:
Server is unwilling to perform: Entry and attributes are
managed by topology plugin.No direct modifications
allowed.\nError caught updating
nsDS5ReplicatedAttributeListTotal: Server is unwilling to
perform: Entry and attributes are managed by topology
plugin.No direct modifications allowed.\nUpdate
complete\nUpgrading the configuration of the IPA
services\n[Verifying that root certificate is
published]\n[Migrate CRL publish directory]\nPublish
directory already set to new location\nForcing update of
template
/usr/share/ipa/ipa-pki-proxy.conf.template\nUpgraded
/etc/httpd/conf.d/ipa-pki-proxy.conf to version
17\n[Ensuring ephemeralRequest is enabled in
KRA]\nephemeralRequest is already enabled\n[Verifying that
KDC configuration is using ipa-kdb backend]\n[Fix DS schema
file syntax]\n[Removing RA cert from DS NSS
database]\n[Enable sidgen and extdom plugins by
default]\n[Updating HTTPD service IPA
configuration]\n[Updating HTTPD service IPA WSGI
configuration]\nNothing to do for
configure_httpd_wsgi_conf\n[Migrating from mod_nss to
mod_ssl]\nAlready migrated to mod_ssl\n[Moving HTTPD service
keytab to gssproxy]\n[Removing self-signed CA]\n[Removing
Dogtag 9 CA]\n[Set OpenSSL engine for BIND]\n[Checking for
deprecated KDC configuration files]\n[Checking for
deprecated backups of Samba configuration
files]\ndnssec-validation yes\n[Add missing CA DNS
records]\nunable to resolve host name
c8kubermaster1.private.lot. to IP address, ipa-ca DNS record
will be incomplete\nIPA server upgrade failed: Inspect
/var/log/ipaupgrade.log and run command ipa-server-upgrade
manually.\nUnexpected error - see /var/log/ipaupgrade.log
for details:\nCalledProcessError: CalledProcessError(Command
[\'/bin/systemctl\', \'start\', \'named.service\'] returned
non-zero exit status 1: \'Job for named.service failed
because the control process exited with error code.\\nSee
"systemctl status named.service" and "journalctl -xeu
named.service" for details.\\n\')\nThe ipa-server-upgrade
command failed. See /var/log/ipaupgrade.log for more
information\n\nSee the upgrade log for more details and/or
run /usr/sbin/ipa-server-upgrade again\nAborting ipactl\n')
so I try:
-> $ ipa-server-upgrade
Upgrading IPA:. Estimated time: 1 minute 30 seconds
[1/9]: saving configuration
[2/9]: disabling listeners
[3/9]: enabling DS global lock
[4/9]: disabling Schema Compat
[5/9]: starting directory server
[error] CalledProcessError: CalledProcessError(Command
['/bin/systemctl', 'start', 'dirsrv(a)PRIVATE-LOT.service']
returned non-zero exit status 1: 'Job for
dirsrv(a)PRIVATE-LOT.service failed because a fatal signal was
delivered causing the control process to dump core.\nSee
"systemctl status dirsrv(a)PRIVATE-LOT.service" and
"journalctl -xeu dirsrv(a)PRIVATE-LOT.service" for details.\n')
[cleanup]: stopping directory server
[cleanup]: restoring configuration
IPA server upgrade failed: Inspect /var/log/ipaupgrade.log
and run command ipa-server-upgrade manually.
Unexpected error - see /var/log/ipaupgrade.log for details:
CalledProcessError: CalledProcessError(Command
['/bin/systemctl', 'start', 'dirsrv(a)PRIVATE-LOT.service']
returned non-zero exit status 1: 'Job for
dirsrv(a)PRIVATE-LOT.service failed because a fatal signal was
delivered causing the control process to dump core.\nSee
"systemctl status dirsrv(a)PRIVATE-LOT.service" and
"journalctl -xeu dirsrv(a)PRIVATE-LOT.service" for details.\n')
The ipa-server-upgrade command failed. See
/var/log/ipaupgrade.log for more information
-> $ journalctl -lf -u dirsrv(a)PRIVATE-LOT.service
Mar 17 16:19:03 c8kubermaster2.private.lot ns-slapd[14967]:
[17/Mar/2023:16:19:03.748676397 +0000] - ERR - cos-plugin -
cos_dn_defs_cb - Skipping CoS Definition cn=Password
Policy,cn=accounts,dc=private,dc=lot--no CoS Templates
found, which should be added before the CoS Definition.
Mar 17 16:19:03 c8kubermaster2.private.lot ns-slapd[14967]:
[17/Mar/2023:16:19:03.764528091 +0000] - ERR - libdb -
BDB2506 file userRoot/replication_changelog.db has LSN
12/7510992, past end of log at 12/2536210
Mar 17 16:19:03 c8kubermaster2.private.lot
ns-slapTrd[14967]: [17/Mar/2023:16:19:03.768119982 +0000] -
ERR - libdb - BDB2507 Commonly caused by moving a database
from one database environment
Mar 17 16:19:03 c8kubermaster2.private.lot ns-slapd[14967]:
[17/Mar/2023:16:19:03.771501904 +0000] - ERR - libdb -
BDB2508 to another without clearing the database LSNs, or by
removing all of
Mar 17 16:19:03 c8kubermaster2.private.lot ns-slapd[14967]:
[17/Mar/2023:16:19:03.774956063 +0000] - ERR - libdb -
BDB2509 the log files from a database environment
Mar 17 16:19:03 c8kubermaster2.private.lot ns-slapd[14967]:
ns-slapd: ldap/servers/plugins/replication/cl5_api.c:1268:
cldb_SetReplicaDB: Assertion `cldb' failed.
Mar 17 16:19:03 c8kubermaster2.private.lot
systemd-coredump[14993]: [🡕] Process 14967 (ns-slapd) of
user 389 dumped core.
Mar 17 16:19:03 c8kubermaster2.private.lot systemd[1]:
dirsrv(a)PRIVATE-LOT.service: Main process exited,
code=dumped, status=6/ABRT
Mar 17 16:19:03 c8kubermaster2.private.lot systemd[1]:
dirsrv(a)PRIVATE-LOT.service: Failed with result 'core-dump'.
Mar 17 16:19:03 c8kubermaster2.private.lot systemd[1]:
Failed to start 389 Directory Server PRIVATE-LOT..
If such simple process should work then please share your
thoughts on what is failing here which can be fixed.
Alternatively, trying the most obvious method - adding new
master to existing domain - fails if the new member/master I
want to make CA, without CA new master installs/adds.
fails:
...
[3/30]: creating ACIs for admin
[4/30]: creating installation admin user
Unable to log in as
uid=admin-c9kmaster1.private.lot,ou=people,o=ipaca on
ldap://c8kubermaster2.private.lot:389
[hint] tune with replication_wait_timeout
[error] NotFound:
uid=admin-c9kmaster1.private.lot,ou=people,o=ipaca did not
replicate to ldap://c8kubermaster2.private.lot:389
and from log file:
...
2023-03-17T17:32:51Z ERROR Unable to log in as
uid=admin-c9kmaster1.private.lot,ou=people,o=ipaca on
ldap://c8kubermaster2.private.lot:389
2023-03-17T17:32:51Z INFO [hint] tune with
replication_wait_timeout
2023-03-17T17:32:51Z DEBUG Traceback (most recent call last):
File
"/usr/lib/python3.9/site-packages/ipaserver/install/service.py",
line 686, in start_creation
run_step(full_msg, method)
File
"/usr/lib/python3.9/site-packages/ipaserver/install/service.py",
line 672, in run_step
method()
File
"/usr/lib/python3.9/site-packages/ipaserver/install/dogtaginstance.py",
line 789, in setup_admin
raise errors.NotFound(
ipalib.errors.NotFound:
uid=admin-c9kmaster1.private.lot,ou=people,o=ipaca did not
replicate to ldap://c8kubermaster2.private.lot:389
2023-03-17T17:32:51Z DEBUG [error] NotFound:
uid=admin-c9kmaster1.private.lot,ou=people,o=ipaca did not
replicate to ldap://c8kubermaster2.private.lot:389
2023-03-17T17:32:51Z DEBUG Removing /root/.dogtag/pki-tomcat/ca
2023-03-17T17:32:51Z DEBUG File
"/usr/lib/python3.9/site-packages/ipapython/admintool.py",
line 180, in execute
...
1 year, 1 month
Win replication
by Алексей Иванов
Greetings,
I'm using ipa-replica-manage connect --winsync to create users from windows
to IPA. But it copies all the users from OU. Can I add an LDAP filter
somewhere so that I will replicate only a subset of users?
Regards,
Alex Ivanov.
1 year, 1 month
Kerberized NFS and IPA
by Ronald Wimmer
We enrolled a RHEL9 server (ipa client) in order to replace an old one
(Centos 7.9). Unfortunately, windows users could not access their
kerberized NFS home share.
Today I rechecked the server and saw that the "trusted for delegation"
flag was not set. (it was set on the old Centos server) I enabled it and
now it seems to work.
Was this probably just a coincidence or can it be explained somehow?
The documentation says:
> OK_AS_DELEGATE
> Use this flag to specify Kerberos tickets trusted for delegation.
> Active directory (AD) clients check the OK_AS_DELEGATE flag on the Kerberos ticket to
> determine whether the user credentials can be forwarded or delegated to the specific server. AD
> forwards the ticket-granting ticket (TGT) only to services or hosts with OK_AS_DELEGATE set.
> With this flag, system security services daemon (SSSD) can add the AD user TGT to the default
> Kerberos credentials cache on the IdM client machine.
Is it needed that the TGT ticket can be forwarded to the server in order
to let the server fetch the NFS-Ticket needed?
Cheers,
Ronald
1 year, 1 month