can clients or servers be pinned to named Active Directory servers to bypass DNS auto-discovery?
Is it possible to override the AD integration use of DNS queries to find AD controllers and replace the auto-discovery with a named list of domain controllers?
We've got a setup in an AWS VPC and we've found that out of the 100 or so domain controllers in DNS that a few of them refuse to talk to us or answer ldaps:// queries. After a lot of nmap and DNS probe work we think we've discovered a number of "bad" controllers that may be responsible for random password check / login failures in the AWS environment
Can the latest sssd/free-ipa be configured to use a list of "known good" domain controllers?
Thanks!
Chris
On ke, 24 loka 2018, Chris Dagdigian via FreeIPA-users wrote:
Is it possible to override the AD integration use of DNS queries to find AD controllers and replace the auto-discovery with a named list of domain controllers?
Where? In 'ipa trust-add' or in SSSD? The former has already a mechanism by specifying a domain controller to contact.
We've got a setup in an AWS VPC and we've found that out of the 100 or so domain controllers in DNS that a few of them refuse to talk to us or answer ldaps:// queries. After a lot of nmap and DNS probe work we think we've discovered a number of "bad" controllers that may be responsible for random password check / login failures in the AWS environment
Can the latest sssd/free-ipa be configured to use a list of "known good" domain controllers?
SSSD can be pinned down to the specific site and also to specific domain controllers in 1.16+. Some of the configurations are possible with earlier versions too, see manual page for sssd-ipa(5), section "Trusted domains configuration".
Thanks! Replies in line
Alexander Bokovoy wrote on 10/24/18 8:40 AM:
On ke, 24 loka 2018, Chris Dagdigian via FreeIPA-users wrote:
Is it possible to override the AD integration use of DNS queries to find AD controllers and replace the auto-discovery with a named list of domain controllers?
Where? In 'ipa trust-add' or in SSSD? The former has already a mechanism by specifying a domain controller to contact.
Trust is already built and that took *months* to arrange with the mysterious AD admins who do not talk to mere mortals. Not going to mess with that! Looking to pin IDM interactions with named AD servers at the sssd.conf level I think
We've got a setup in an AWS VPC and we've found that out of the 100 or so domain controllers in DNS that a few of them refuse to talk to us or answer ldaps:// queries. After a lot of nmap and DNS probe work we think we've discovered a number of "bad" controllers that may be responsible for random password check / login failures in the AWS environment
Can the latest sssd/free-ipa be configured to use a list of "known good" domain controllers?
SSSD can be pinned down to the specific site and also to specific domain controllers in 1.16+. Some of the configurations are possible with earlier versions too, see manual page for sssd-ipa(5), section "Trusted domains configuration".
Thank you ! We will research/test this
Love this list and the resources on it!
Regards, Chris
On Wed, Oct 24, 2018 at 08:53:10AM -0400, Chris Dagdigian via FreeIPA-users wrote:
Thanks! Replies in line
Alexander Bokovoy wrote on 10/24/18 8:40 AM:
On ke, 24 loka 2018, Chris Dagdigian via FreeIPA-users wrote:
Is it possible to override the AD integration use of DNS queries to find AD controllers and replace the auto-discovery with a named list of domain controllers?
Where? In 'ipa trust-add' or in SSSD? The former has already a mechanism by specifying a domain controller to contact.
Trust is already built and that took *months* to arrange with the mysterious AD admins who do not talk to mere mortals. Not going to mess with that! Looking to pin IDM interactions with named AD servers at the sssd.conf level I think
We've got a setup in an AWS VPC and we've found that out of the 100 or so domain controllers in DNS that a few of them refuse to talk to us or answer ldaps:// queries. After a lot of nmap and DNS probe work we think we've discovered a number of "bad" controllers that may be responsible for random password check / login failures in the AWS environment
Can the latest sssd/free-ipa be configured to use a list of "known good" domain controllers?
SSSD can be pinned down to the specific site and also to specific domain controllers in 1.16+. Some of the configurations are possible with earlier versions too, see manual page for sssd-ipa(5), section "Trusted domains configuration".
Thank you ! We will research/test this
Love this list and the resources on it!
A small correction to Alexander's mail:
On IPA masters themselves, setting something like: [domain/ipa.domain/ad.domain] ad_server = foo, bar, baz
or even just: [domain/ipa.domain/ad.domain] ad_site = my.site
was working since 1.15: https://docs.pagure.org/SSSD.sssd/design_pages/subdomain_configuration.html
but clients were a different matter and the above configurations would only work since versions that implement: https://docs.pagure.org/SSSD.sssd/design_pages/kdcinfo_improvements.html upstream-wise this is since 1.16.3, but the patches were also backported to RHEL-7.6 (which should be released in short future)
If you have an older client, you can work around this issue by setting the AD DCs in krb5.conf (yes, krb5.conf, not sssd.conf) directly.
HTH
freeipa-users@lists.fedorahosted.org
-
Alexander Bokovoy -
Chris Dagdigian -
Jakub Hrozek