Encryption type errors with AD cross-forest trust
by Owen Vincent
Hi everyone,
Up front, a tl;dr, we are having trouble getting our FreeIPA cross-forest trust to allow us to authenticate AD users on our Linux machines using ssh. It seems like the AD is only allowing RC4 encryption and won’t allow us to enable AES encryption. The “the other domain supports Kerberos AES encryption” checkbox in AD’s trust settings is grayed out and cannot be set. Trying to manually set msDS-SupportedEncryptionTypes to 24 or 28 (or 0x18, 0x1c) results in the following error: "Operation failed. Error code: 0x2077 Illegal modify operation. Some aspect of the modification is not permitted. 00002077: SvcErr: DSID-0319039A, problem 5003 (WILL_NOT_PERFORM), data 0."
The main questions are: is there something that needs to be set on the FreeIPA side for AD to allow these settings to be enabled? Have you encountered similar issues in the past? Do you have any ideas what we could try to get authentication working?
There are also some less pressing questions at the bottom of the post, in case you have any answers to those.
Thanks in advance!
Best,
Owen
The longer version:
I’ve been trying to get this to work for a couple of weeks now and each time I solve one problem, another pops up. I think I have narrowed it down to one of the final issues, but given the way things have been going, I could well be wrong. I have tried to find more information online, but nothing really seems to fit my situation, so I decided to ask you guys for help.
First off a little background information, this is setup is at a relatively large organization with a well established AD. I have don’t have admin access on the AD controllers, but do have read access, it doesn’t allow me to see some things (e.g. all of the AES encryption check boxes are grayed out when I look on my user). The AD admin has been very agreeable overall and has done the things we have asked them to do, but hasn’t taken much initiative in helping solve the problem, so we need to be as precise and descriptive as possible when making suggestions.
The AD setup seems to be a little weird (though I’m not sure as I don’t have much experience with windows servers and AD). The domain controllers are all running Windows Server 2016, the domain functional level is 2012 R2, and the forest functional level is 2008 R2. I have the feeling that this might be part of the problem, but again, I don’t have much experience with windows.
Where we stand now: we have successfully established a one-way cross-forest trust between the AD root domain and our FreeIPA installation. Both on the AD side and on our side DNS is run separate from AD/FreeIPA, in case that matters, but the necessary entries are configured and were working well enough to establish the trust. On the FreeIPA machines we can run getent passwd user1@AD and get a valid response, ID View overrides are also in effect when using getent (ID Views are the primary reason for trying to setup FreeIPA), however those users are unable to login via ssh.
At this point when we try to login via ssh we get this error the journal on the FreeIPA server we are trying to login to:
krb5_child[3343]: KDC has no support for encryption type
and this in /var/log/sssd/krb5_child.log:
(2021-05-10 10:49:12): [krb5_child[3343]] [validate_tgt] (0x0020): TGT failed verification using key for [host/ipac1.domain.com(a)IPA.DOMAIN.COM].
(2021-05-10 10:49:12): [krb5_child[3343]] [get_and_save_tgt] (0x0020): 1762: [-1765328370][KDC has no support for encryption type]
(2021-05-10 10:49:12): [krb5_child[3343]] [map_krb5_error] (0x0020): 1854: [-1765328370][KDC has no support for encryption type]
(I can provide more detailed logs in needed, though I would prefer not to do that on a public channel)
When doing a packet capture (tcpdump/wireshark) of this login attempt we can see:
1) a successful AS-REQ and AS-REP for CNameString IPA$ in realm AD.DOMAIN.COM for SnameString krbtgt/AD.DOMAIN.COM
2) a successful TGS-REQ and TGS-REP in realm AD.DOMAIN.COM for SnameString ldap/adc01.ad.domain.com
3) a successful encrypted LDAP session between the freeipa machine and adc01.ad.domain.com
4) the same process in 1-3 for adc02.ad.domain.com as well
5) a successful AS-REQ and AS-REP for CNameString user1(a)DOMAIN.COM in realm AD.DOMAIN.COM for SnameString krbtgt/AD.DOMAIN.COM
6) a failed TGS-REQ and TGS-REP in realm AD.DOMAIN.COM for SnameString krbtgt/IPA.DOMAIN.COM with the error: KRB5KDC_ERR_ETYPE_NOSUPP
This lead us to some googling and then testing with the following added to our /etc/krb5.conf.d/freeipa file:
default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac
default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac
permitted_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac
(Note: I know we RC4 is not advisable, this was a test to figure out what was going on.)
Which got us a step further, now when trying to authenticate we would get this error in our journal:
krb5_child[2159]: KDC returned error string: PROCESS_TGS
and this in /var/log/sssd/krb5_child.log:
(2021-05-10 10:45:25): [krb5_child[2159]] [validate_tgt] (0x0020): TGT failed verification using key for [host/ipac1.domain.com(a)IPA.DOMAIN.COM].
(2021-05-10 10:45:25): [krb5_child[2159]] [get_and_save_tgt] (0x0020): 1762: [-1765328324][KDC returned error string: PROCESS_TGS]
(2021-05-10 10:45:25): [krb5_child[2159]] [map_krb5_error] (0x0020): 1854: [-1765328324][KDC returned error string: PROCESS_TGS]
Again, this let to some googling, after which we added the following line to our /etc/sssd/sssd.conf [global] section:
krb5_validate = False
(Note: I know turning off krb5 validation is not a good idea, this was a test to figure out what was going on.)
At this point AD users could successfully login via ssh on the FreeIPA servers. When they were logging in the packet capture looked very similar to the previous packet capture from above, with the exception that step 6 resulted in a successful TGS-REQ and TGS-REP, however using eTYPE-ARCFOUR-HMAC-MD5, while the rest of the exchange was done entirely in eTYPE-AES256-CTS-HMAC-SHA1-96.
The whole point of going through all that was to try to narrow down where the configuration issue is. It definitely appears to be that that AD is not allowing AES encryption to be used for a necessary part of the trust relationship, which is causing problems. In the AD Trust settings the “the other domain supports Kerberos AES encryption” checkbox is grayed out and cannot be set. When you open the trust in AD’s ADSI Editor you can see that msDS-SupportedEncryptionTypes is <not set>, which means it defaults to 0 or only RC4 (which is also how it’s behaving). When trying to manually set msDS-SupportedEncryptionTypes to 24 or 28 (or 0x18, 0x1c) results in the following error: "Operation failed. Error code: 0x2077 Illegal modify operation. Some aspect of the modification is not permitted. 00002077: SvcErr: DSID-0319039A, problem 5003 (WILL_NOT_PERFORM), data 0."
I wasn’t able to find any really helpful information about the check box being grayed out. The most extensive discussion I could find was this link: https://social.technet.microsoft.com/Forums/en-US/7f43b815-46a8-483c-a8d7... But that only vaguely suggests recreating the trust might help. We have already recreated the trust on both ends and it hasn’t enabled the check box.
I also looked up the “Operation failed. Error code: 0x2077 Illegal modify operation.” error and found this: https://community.spiceworks.com/topic/1824257-cannot-change-domain-attri... But this one discusses password related GPO information. I don’t know if that would affect the msDS-SupportedEncryptionTypes attribute in the same way, or if that attribute has a GPO related setting. It also discusses the default domain policy being corrupted, which I’m a little worried about implying, as I’m not sure if the agreeableness of the AD Admin would continue into rebuilding the default domain policy.
If you have read this far, thank you for your dedication. I know it was a lot, but I wanted to be thorough. Now for the questions: Is there something that needs to be set on the FreeIPA side for AD to allow the Kerberos AES encryption checkbox to be enabled? Have you encountered similar issues in the past? Do you have any ideas what we could try to get authentication working with proper encryption? Is there anything else we aren’t not thinking about that you think would be relevant to this situation?
Of lesser importance:
Why is there a validation error after enabling RC4 but before disabling krb5 validation? Is it because RC4 is deprecated? Or is there another reason? (we DON’T want to use RC4, we’re just curious)
Again, Thanks in advance!
Best,
Owen
3 years
posix and non-posix AD users
by iulian roman
I have configured a trust between IdM and Active Directory with posix range type. The users which do have an uidNumber in AD are correctly listed, but those without uidNumber are not (similar for the groups).
Is there any setting or possibility to have the AD users without uidNumber get an uid generated automatically (if they do not have one in AD) by IPA and listed as AD users in Linux ?
3 years
Problem with Client Installs on Centos 7
by Steve Reed
Hi all,
I am running Versions 4.8 of the client installations. I have one machine that installed except it failed to configure the krb5.conf file properly and it fails saying that it can't find the KDC for the realm xyz.com. I can fix Kerberos by manually editing the kfb5.conf file. Except for the rest of the machines which won't work for ldap logins, but Kerberos works fine.
Prior to the installation, I make sure the resolv.conf file is configured properly. I make sure that the /etc/hosts file has the proper entries for the machine I am installing on and the server. No extraneous domain names. Also, I make sure the hostname is fully qualified with the domain name. I turn off any potential firewalld, iptables or ip6tables services as well.
This is the installation command:
ipa-client-install --mkhomedir -p admin -w PassWord@12345! --ntp-server=idm.xyz.com --unattended --force-join --realm XYZ.COM
2021-05-07T20:36:19Z DEBUG Logging to /var/log/ipaclient-install.log
2021-05-07T20:36:19Z DEBUG ipa-client-install was invoked with arguments [] and options: {'no_dns_sshfp': False, 'force': False, 'verbose': False, 'ip_addresses': None, 'configure_firefox': False, 'realm_name': 'XYZ.COM', 'force_ntpd': False, 'on_master': False, 'no_nisdomain': False, 'ssh_trust_dns': False, 'principal': 'admin', 'keytab': None, 'no_ntp': False, 'domain_name': None, 'request_cert': False, 'fixed_primary': False, 'no_ac': False, 'no_sudo': False, 'ca_cert_files': None, 'all_ip_addresses': False, 'kinit_attempts': None, 'ntp_servers': ['idm.xyz.com'], 'enable_dns_updates': False, 'no_sshd': False, 'no_sssd': False, 'no_krb5_offline_passwords': False, 'servers': None, 'no_ssh': False, 'force_join': True, 'firefox_dir': None, 'unattended': True, 'quiet': False, 'nisdomain': None, 'prompt_password': False, 'host_name': None, 'permit': False, 'automount_location': None, 'preserve_sssd': False, 'mkhomedir': True, 'log_file': None, 'uninstall': False}
2021-05-07T20:36:19Z DEBUG IPA version 4.6.8-5.el7.centos
2021-05-07T20:36:19Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
2021-05-07T20:36:19Z DEBUG Starting external process
2021-05-07T20:36:19Z DEBUG args=/usr/sbin/selinuxenabled
2021-05-07T20:36:19Z DEBUG Process finished, return code=0
2021-05-07T20:36:19Z DEBUG stdout=
2021-05-07T20:36:19Z DEBUG stderr=
2021-05-07T20:36:19Z DEBUG Starting external process
2021-05-07T20:36:19Z DEBUG args=/bin/systemctl is-enabled chronyd.service
2021-05-07T20:36:19Z DEBUG Process finished, return code=0
2021-05-07T20:36:19Z DEBUG stdout=enabled
2021-05-07T20:36:19Z DEBUG stderr=
2021-05-07T20:36:19Z DEBUG [IPA Discovery]
2021-05-07T20:36:19Z DEBUG Starting IPA discovery with domain=None, servers=None, hostname=client1.xyz.com
2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in "xyz.com" (domain of the hostname) and its sub-domains
2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _ldap._tcp.xyz.com
2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389 idm.xyz.com.
2021-05-07T20:36:19Z DEBUG [Kerberos realm search]
2021-05-07T20:36:19Z DEBUG Kerberos realm forced
2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _kerberos._udp.xyz.com
2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 88 idm.xyz.com.
2021-05-07T20:36:19Z DEBUG [LDAP server check]
2021-05-07T20:36:19Z DEBUG Verifying that idm.xyz.com (realm XYZ.COM) is an IPA server
2021-05-07T20:36:19Z DEBUG Init LDAP connection to: ldap://idm.xyz.com:389
2021-05-07T20:36:19Z DEBUG Search LDAP server for IPA base DN
2021-05-07T20:36:19Z DEBUG Check if naming context 'dc=xyz,dc=com' is for IPA
2021-05-07T20:36:19Z DEBUG Naming context 'dc=xyz,dc=com' is a valid IPA context
2021-05-07T20:36:19Z DEBUG Search for (objectClass=krbRealmContainer) in dc=xyz,dc=com (sub)
2021-05-07T20:36:19Z DEBUG Found: cn=XYZ.COM,cn=kerberos,dc=xyz,dc=com
2021-05-07T20:36:19Z DEBUG Discovery result: Success; server=idm.xyz.com, domain=xyz.com, kdc=idm.xyz.com, basedn=dc=xyz,dc=com
2021-05-07T20:36:19Z DEBUG Validated servers: idm.xyz.com
2021-05-07T20:36:19Z DEBUG will use discovered domain: xyz.com
2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in "xyz.com" (Validating DNS Discovery) and its sub-domains
2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _ldap._tcp.xyz.com
2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389 idm.xyz.com.
2021-05-07T20:36:19Z DEBUG DNS validated, enabling discovery
2021-05-07T20:36:19Z DEBUG will use discovered server: idm.xyz.com
2021-05-07T20:36:19Z INFO Discovery was successful!
2021-05-07T20:36:19Z DEBUG will use discovered realm: XYZ.COM
2021-05-07T20:36:19Z DEBUG will use discovered basedn: dc=xyz,dc=com
2021-05-07T20:36:19Z INFO Client hostname: client1.xyz.com
2021-05-07T20:36:19Z DEBUG Hostname source: Machine's FQDN
2021-05-07T20:36:19Z INFO Realm: XYZ.COM
2021-05-07T20:36:19Z DEBUG Realm source: Discovered from LDAP DNS records in idm.xyz.com
2021-05-07T20:36:19Z INFO DNS Domain: xyz.com
2021-05-07T20:36:19Z DEBUG DNS Domain source: Discovered LDAP SRV records from xyz.com (domain of the hostname)
2021-05-07T20:36:19Z INFO IPA Server: idm.xyz.com
2021-05-07T20:36:19Z DEBUG IPA Server source: Discovered from LDAP DNS records in idm.xyz.com
2021-05-07T20:36:19Z INFO BaseDN: dc=xyz,dc=com
2021-05-07T20:36:19Z DEBUG BaseDN source: From IPA server ldap://idm.xyz.com:389
2021-05-07T20:36:19Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
2021-05-07T20:36:19Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
2021-05-07T20:36:19Z DEBUG Starting external process
2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r XYZ.COM
2021-05-07T20:36:19Z DEBUG Process finished, return code=5
2021-05-07T20:36:19Z DEBUG stdout=
2021-05-07T20:36:19Z DEBUG stderr=realm not found
2021-05-07T20:36:19Z INFO Skipping synchronizing time with NTP server.
2021-05-07T20:36:19Z DEBUG Starting external process
2021-05-07T20:36:19Z DEBUG args=/usr/bin/keyctl get_persistent @s 0
2021-05-07T20:36:19Z DEBUG Process finished, return code=0
2021-05-07T20:36:19Z DEBUG stdout=599779671
2021-05-07T20:36:19Z DEBUG stderr=
2021-05-07T20:36:19Z DEBUG Enabling persistent keyring CCACHE
2021-05-07T20:36:19Z DEBUG Writing Kerberos configuration to /tmp/tmpfFCY1T:
2021-05-07T20:36:19Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = XYZ.COM
dns_lookup_realm = false
dns_lookup_kdc = false
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
XYZ.COM = {
kdc = idm.xyz.com:88
master_kdc = idm.xyz.com:88
admin_server = idm.xyz.com:749
kpasswd_server = idm.xyz.com:464
default_domain = xyz.com
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.xyz.com = XYZ.COM
xyz.com = XYZ.COM
client1.xyz.com = XYZ.COM
2021-05-07T20:36:19Z DEBUG Initializing principal admin(a)XYZ.COM using password
2021-05-07T20:36:19Z DEBUG Starting external process
2021-05-07T20:36:19Z DEBUG args=/usr/bin/kinit admin(a)XYZ.COM -c /tmp/krbccnj9ncO/ccache
2021-05-07T20:36:19Z DEBUG Process finished, return code=0
2021-05-07T20:36:19Z DEBUG stdout=Password for admin(a)XYZ.COM:
2021-05-07T20:36:19Z DEBUG stderr=
2021-05-07T20:36:19Z DEBUG trying to retrieve CA cert via LDAP from idm.xyz.com
2021-05-07T20:36:19Z DEBUG retrieving schema for SchemaCache url=ldap://idm.xyz.com:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fc3c40d7248>
2021-05-07T20:36:19Z INFO Successfully retrieved CA cert
Subject: CN=Certificate Authority,O=XYZ.COM
Issuer: CN=Certificate Authority,O=XYZ.COM
Valid From: 2021-05-06 19:54:28
Valid Until: 2041-05-06 19:54:28
2021-05-07T20:36:19Z DEBUG Starting external process
2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-join -s idm.xyz.com -b dc=xyz,dc=com -h client1.xyz.com -f
2021-05-07T20:36:20Z DEBUG Process finished, return code=0
2021-05-07T20:36:20Z DEBUG stdout=
2021-05-07T20:36:20Z DEBUG stderr=Keytab successfully retrieved and stored in: /etc/krb5.keytab
Certificate subject base is: O=XYZ.COM
2021-05-07T20:36:20Z INFO Enrolled in IPA realm XYZ.COM
2021-05-07T20:36:20Z DEBUG Starting external process
2021-05-07T20:36:20Z DEBUG args=/usr/bin/kdestroy
2021-05-07T20:36:20Z DEBUG Process finished, return code=0
2021-05-07T20:36:20Z DEBUG stdout=
2021-05-07T20:36:20Z DEBUG stderr=
2021-05-07T20:36:20Z DEBUG Initializing principal host/client1.xyz.com(a)XYZ.COM using keytab /etc/krb5.keytab
2021-05-07T20:36:20Z DEBUG using ccache /etc/ipa/.dns_ccache
2021-05-07T20:36:20Z DEBUG Attempt 1/5: success
2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/ipa/default.conf'
2021-05-07T20:36:20Z DEBUG -> Not backing up - '/etc/ipa/default.conf' doesn't exist
2021-05-07T20:36:20Z INFO Created /etc/ipa/default.conf
2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/sssd/sssd.conf'
2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index'
2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/nsswitch.conf'
2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index'
2021-05-07T20:36:20Z INFO Configured sudoers in /etc/nsswitch.conf
2021-05-07T20:36:20Z INFO Configured /etc/sssd/sssd.conf
2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/krb5.conf'
2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index'
2021-05-07T20:36:20Z DEBUG Starting external process
2021-05-07T20:36:20Z DEBUG args=/usr/bin/keyctl get_persistent @s 0
2021-05-07T20:36:20Z DEBUG Process finished, return code=0
2021-05-07T20:36:20Z DEBUG stdout=599779671
2021-05-07T20:36:20Z DEBUG stderr=
2021-05-07T20:36:20Z DEBUG Enabling persistent keyring CCACHE
2021-05-07T20:36:20Z DEBUG Writing Kerberos configuration to /etc/krb5.conf:
2021-05-07T20:36:20Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = XYZ.COM
dns_lookup_realm = true
dns_lookup_kdc = true
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
XYZ.COM = {
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.xyz.com = XYZ.COM
xyz.com = XYZ.COM
client1.xyz.com = XYZ.COM
2021-05-07T20:36:20Z INFO Configured /etc/krb5.conf for IPA realm XYZ.COM
2021-05-07T20:36:20Z DEBUG Starting external process
2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d dbm:/tmp/tmpxItqiM -N -f /tmp/tmpxItqiM/pwdfile.txt -f /tmp/tmpxItqiM/pwdfile.txt
2021-05-07T20:36:20Z DEBUG Process finished, return code=0
2021-05-07T20:36:20Z DEBUG stdout=
2021-05-07T20:36:20Z DEBUG stderr=
2021-05-07T20:36:20Z DEBUG Starting external process
2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d dbm:/tmp/tmpxItqiM -A -n CA certificate 1 -t C,, -a -f /tmp/tmpxItqiM/pwdfile.txt
2021-05-07T20:36:20Z DEBUG Process finished, return code=0
2021-05-07T20:36:20Z DEBUG stdout=
2021-05-07T20:36:20Z DEBUG stderr=
2021-05-07T20:36:20Z DEBUG failed to find session_cookie in persistent storage for principal 'host/client1.xyz.com(a)XYZ.COM'
2021-05-07T20:36:20Z INFO trying https://idm.xyz.com/ipa/json
2021-05-07T20:36:20Z DEBUG Created connection context.rpcclient_140479019423504
2021-05-07T20:36:20Z INFO [try 1]: Forwarding 'schema' to json server 'https://idm.xyz.com/ipa/json'
2021-05-07T20:36:20Z DEBUG New HTTP connection (idm.xyz.com)
2021-05-07T20:36:20Z DEBUG HTTP connection destroyed (idm.xyz.com)
Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in single_request
self.get_auth_info()
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in get_auth_info
self._handle_exception(e, service=service)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in _handle_exception
raise errors.KerberosError(message=unicode(e))
KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM'
2021-05-07T20:36:20Z DEBUG Destroyed connection context.rpcclient_140479019423504
2021-05-07T20:36:20Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run
return cfgr.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 360, in run
return self.execute()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 386, in execute
for rval in self._executor():
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 655, in _configure
next(executor)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 515, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install
for unused in self._installer(self.parent):
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3670, in main
install(self)
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2391, in install
_install(options)
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2733, in _install
api.finalize()
File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 740, in finalize
self.__do_if_not_done('load_plugins')
File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 431, in __do_if_not_done
getattr(self, name)()
File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 619, in load_plugins
for package in self.packages:
File "/usr/lib/python2.7/site-packages/ipalib/__init__.py", line 954, in packages
ipaclient.remote_plugins.get_package(self),
File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/__init__.py", line 134, in get_package
plugins = schema.get_package(server_info, client)
File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 553, in get_package
schema = Schema(client)
File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 401, in __init__
fingerprint, ttl = self._fetch(client, ignore_cache=read_failed)
File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 426, in _fetch
schema = client.forward(u'schema', **kwargs)['result']
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1151, in forward
return self._call_command(command, params)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1127, in _call_command
return command(*params)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1281, in _call
return self.__request(name, args)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1248, in __request
verbose=self.__verbose >= 3,
File "/usr/lib64/python2.7/xmlrpclib.py", line 1273, in request
return self.single_request(host, handler, request_body, verbose)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in single_request
self.get_auth_info()
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in get_auth_info
self._handle_exception(e, service=service)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in _handle_exception
raise errors.KerberosError(message=unicode(e))
2021-05-07T20:36:20Z DEBUG The ipa-client-install command failed, exception: KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM'
2021-05-07T20:36:20Z ERROR Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM'
2021-05-07T20:36:20Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information
So, what I found is that the krb5.conf file is partially configured. I'm not sure what to look for in the sssd.conf file. I am assuming that since I can't login with an ldap account and it finds the domain that something is not cofigured properly for that either.
Any thoughts on what is going wrong? And how I can fix it or work around it? I'm more worried about not being able to do ldap logins than the Kerberos problem since I have a work around for that.
Thanks,
Steve
3 years
Re: [SSSD-users] Re: Announcing SSSD 2.5.0
by Pavel Březina
On 5/10/21 8:10 PM, Joakim Tjernlund wrote:
> On Mon, 2021-05-10 at 16:01 +0000, Joakim Tjernlund wrote:
>> On Mon, 2021-05-10 at 17:48 +0200, Pavel Březina wrote:
>>> On 5/10/21 5:12 PM, Joakim Tjernlund wrote:
>>>> On Mon, 2021-05-10 at 14:53 +0000, Joakim Tjernlund wrote:
>>>>> I decided to test new sssd/KCM and this is what I get:
>>>>>
>>>>> - ssh from non sssd/krb machine to new sssd machine, entered password
>>>>> ~ $ klist
>>>>> Ticket cache: KCM:1001
>>>>> Default principal: jocke(a)INFINERA.COM
>>>>>
>>>>> Valid starting Expires Service principal
>>>>> 10/05/21 16:47:32 11/05/21 02:47:32 krbtgt/INFINERA.COM(a)INFINERA.COM
>>>>> renew until 17/05/21 16:47:32
>>>>> ~ $ ksu
>>>>> ksu: Ccache function not supported: not implemented while selecting the best principal
>>>>>
>>>>> I also have mit-kr5b master installed.
>>>>>
>>>>> Did I miss something?
>>>
>>>
>>> krb5 master contains:
>>> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub....
>>>
>>> but RETRIEVE is not implemented in sssd-kcm. Kerberos should fallback to
>>> its own function that was used before this commit.
>
> FYI, reverting that commit makes it work.
Thanks for the information. Please, open a ticket against krb5.
>
> Jocke
>
3 years
Problem upgrading centos7 to centos8
by Kees Bakker
Hi,
Trying to upgrade CentOS 7 tot CentOS 8, following the various hints on the internet. Executing this command fails
# dnf --releasever=8 --allowerasing --setopt=deltarpm=false distro-sync
...
Running transaction check
Error: transaction check vs depsolve:
(ipa-selinux = 4.8.7-12.module_el8.3.0+514+e7703106 if selinux-policy-targeted) is needed by ipa-common-4.8.7-12.module_el8.3.0+514+e7703106.noarch
rpmlib(RichDependencies) <= 4.12.0-1 is needed by ipa-common-4.8.7-12.module_el8.3.0+514+e7703106.noarch
To diagnose the problem, try running: 'rpm -Va --nofiles --nodigest'.
You probably have corrupted RPMDB, running 'rpm --rebuilddb' might fix the issue.
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
How can I solve this?
--
Kees
3 years
Re: [SSSD-users] Re: Announcing SSSD 2.5.0
by Pavel Březina
On 5/10/21 5:12 PM, Joakim Tjernlund wrote:
> On Mon, 2021-05-10 at 14:53 +0000, Joakim Tjernlund wrote:
>> I decided to test new sssd/KCM and this is what I get:
>>
>> - ssh from non sssd/krb machine to new sssd machine, entered password
>> ~ $ klist
>> Ticket cache: KCM:1001
>> Default principal: jocke(a)INFINERA.COM
>>
>> Valid starting Expires Service principal
>> 10/05/21 16:47:32 11/05/21 02:47:32 krbtgt/INFINERA.COM(a)INFINERA.COM
>> renew until 17/05/21 16:47:32
>> ~ $ ksu
>> ksu: Ccache function not supported: not implemented while selecting the best principal
>>
>> I also have mit-kr5b master installed.
>>
>> Did I miss something?
krb5 master contains:
https://github.com/krb5/krb5/commit/795ebba8c039be172ab93cd41105c73ffdba0fdb
but RETRIEVE is not implemented in sssd-kcm. Kerberos should fallback to
its own function that was used before this commit.
>
> Get a KCM trace for ksu:
>
> (2021-05-10 17:09:47): [kcm] [get_client_cred] (0x4000): Client [0x56377e20ead0][14] creds: euid[1001] egid[100] pid[5871] cmd_line['ksu'].
> (2021-05-10 17:09:47): [kcm] [get_client_cred] (0x0080): The following failure is expected to happen in case SELinux is disabled:
> SELINUX_getpeercon failed [95][Operation not supported].
> Please, consider enabling SELinux in your system.
> (2021-05-10 17:09:47): [kcm] [setup_client_idle_timer] (0x4000): Idle timer re-set for client [0x56377e20ead0][14]
> (2021-05-10 17:09:47): [kcm] [accept_fd_handler] (0x0400): Client [0x56377e20ead0][14] connected!
> (2021-05-10 17:09:47): [kcm] [kcm_input_parse] (0x1000): Received message with length 4
> (2021-05-10 17:09:47): [kcm] [kcm_get_opt] (0x2000): The client requested operation 20
> (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x0400): KCM operation GET_DEFAULT_CACHE
> (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x1000): 0 bytes on KCM input
> (2021-05-10 17:09:47): [kcm] [kcm_op_queue_send] (0x0200): Adding request by 1001 to the wait queue
> (2021-05-10 17:09:47): [kcm] [kcm_op_queue_get] (0x1000): No existing queue for this ID
> (2021-05-10 17:09:47): [kcm] [kcm_op_queue_send] (0x1000): Queue was empty, running the request immediately
> (2021-05-10 17:09:47): [kcm] [kcm_op_get_default_ccache_send] (0x1000): Getting client's default ccache
> (2021-05-10 17:09:47): [kcm] [ccdb_secdb_get_default_send] (0x2000): Getting the default ccache
> (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/
> (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/default]
> (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/default] is [cn=default,cn=1001,cn=persistent,cn=kcm]
> (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/default
> (2021-05-10 17:09:47): [kcm] [secdb_dfl_url_req] (0x2000): Created request for URL /kcm/persistent/1001/default
> (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x0400): Retrieving a secret from [persistent/1001/default]
> (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=default,cn=1001,cn=persistent,cn=kcm] with scope=base
> (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x1000): No secret found
> (2021-05-10 17:09:47): [kcm] [sec_get] (0x0040): Cannot retrieve the secret [2]: No such file or directory
> (2021-05-10 17:09:47): [kcm] [ccdb_secdb_list_send] (0x2000): Listing all ccaches
> (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/
> (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/ccache/]
> (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/ccache/] is [cn=ccache,cn=1001,cn=persistent,cn=kcm]
> (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/ccache/
> (2021-05-10 17:09:47): [kcm] [secdb_container_url_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/
> (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x0400): Listing keys at [persistent/1001/ccache/]
> (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=ccache,cn=1001,cn=persistent,cn=kcm] with scope=subtree
> (2021-05-10 17:09:47): [kcm] [local_dn_to_path] (0x2000): Secrets path for [cn=5005e896-bdfb-4116-8a11-eedacad1fa5b-1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] is [5005e896-
> bdfb-4116-8a11-eedacad1fa5b-1001]
> (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x1000): Returning 1 secrets
> (2021-05-10 17:09:47): [kcm] [ccdb_secdb_list_send] (0x2000): Found 1 ccaches
> (2021-05-10 17:09:47): [kcm] [ccdb_secdb_list_send] (0x2000): Listing all caches done
> (2021-05-10 17:09:47): [kcm] [ccdb_secdb_name_by_uuid_send] (0x2000): Translating UUID to name
> (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/
> (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/ccache/]
> (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/ccache/] is [cn=ccache,cn=1001,cn=persistent,cn=kcm]
> (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/ccache/
> (2021-05-10 17:09:47): [kcm] [secdb_container_url_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/
> (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x0400): Listing keys at [persistent/1001/ccache/]
> (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=ccache,cn=1001,cn=persistent,cn=kcm] with scope=subtree
> (2021-05-10 17:09:47): [kcm] [local_dn_to_path] (0x2000): Secrets path for [cn=5005e896-bdfb-4116-8a11-eedacad1fa5b-1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] is [5005e896-
> bdfb-4116-8a11-eedacad1fa5b-1001]
> (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x1000): Returning 1 secrets
> (2021-05-10 17:09:47): [kcm] [key_by_uuid] (0x2000): Found key 5005e896-bdfb-4116-8a11-eedacad1fa5b-1001
> (2021-05-10 17:09:47): [kcm] [ccdb_secdb_name_by_uuid_send] (0x2000): Got ccache by UUID
> (2021-05-10 17:09:47): [kcm] [kcm_op_get_default_ccache_reply_step] (0x2000): The default ccache is 1001
> (2021-05-10 17:09:47): [kcm] [kcm_cmd_done] (0x0400): KCM operation GET_DEFAULT_CACHE returned [0]: Success
> (2021-05-10 17:09:47): [kcm] [kcm_send_reply] (0x2000): Sending a reply
> (2021-05-10 17:09:47): [kcm] [kcm_output_construct] (0x1000): Sending a reply with 9 bytes of payload
> (2021-05-10 17:09:47): [kcm] [queue_removal_cb] (0x0200): Removed queue for 1001
> (2021-05-10 17:09:47): [kcm] [kcm_send] (0x2000): All data sent!
> (2021-05-10 17:09:47): [kcm] [kcm_input_parse] (0x1000): Received message with length 9
> (2021-05-10 17:09:47): [kcm] [kcm_get_opt] (0x2000): The client requested operation 8
> (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x0400): KCM operation GET_PRINCIPAL
> (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x1000): 5 bytes on KCM input
> (2021-05-10 17:09:47): [kcm] [kcm_op_queue_send] (0x0200): Adding request by 1001 to the wait queue
> (2021-05-10 17:09:47): [kcm] [kcm_op_queue_get] (0x1000): No existing queue for this ID
> (2021-05-10 17:09:47): [kcm] [kcm_op_queue_send] (0x1000): Queue was empty, running the request immediately
> (2021-05-10 17:09:47): [kcm] [kcm_op_get_principal_send] (0x1000): Requested principal 1001
> (2021-05-10 17:09:47): [kcm] [ccdb_secdb_getbyname_send] (0x2000): Getting ccache by name
> (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/
> (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/ccache/]
> (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/ccache/] is [cn=ccache,cn=1001,cn=persistent,cn=kcm]
> (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/ccache/
> (2021-05-10 17:09:47): [kcm] [secdb_container_url_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/
> (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x0400): Listing keys at [persistent/1001/ccache/]
> (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=ccache,cn=1001,cn=persistent,cn=kcm] with scope=subtree
> (2021-05-10 17:09:47): [kcm] [local_dn_to_path] (0x2000): Secrets path for [cn=5005e896-bdfb-4116-8a11-eedacad1fa5b-1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] is [5005e896-
> bdfb-4116-8a11-eedacad1fa5b-1001]
> (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x1000): Returning 1 secrets
> (2021-05-10 17:09:47): [kcm] [key_by_name] (0x2000): Found key 5005e896-bdfb-4116-8a11-eedacad1fa5b-1001
> (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/
> (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001]
> (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001] is [cn=5005e896-bdfb-4116-8a11-
> eedacad1fa5b-1001,cn=ccache,cn=1001,cn=persistent,cn=kcm]
> (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001
> (2021-05-10 17:09:47): [kcm] [secdb_cc_url_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001
> (2021-05-10 17:09:47): [kcm] [secdb_cc_key_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001
> (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x0400): Retrieving a secret from [persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001]
> (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=5005e896-bdfb-4116-8a11-eedacad1fa5b-
> 1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] with scope=base
> (2021-05-10 17:09:47): [kcm] [secdb_get_cc] (0x2000): Fetched the ccache
> (2021-05-10 17:09:47): [kcm] [ccdb_secdb_getbyname_send] (0x2000): Got ccache by name
> (2021-05-10 17:09:47): [kcm] [kcm_cmd_done] (0x0400): KCM operation GET_PRINCIPAL returned [0]: Success
> (2021-05-10 17:09:47): [kcm] [kcm_send_reply] (0x2000): Sending a reply
> (2021-05-10 17:09:47): [kcm] [kcm_output_construct] (0x1000): Sending a reply with 37 bytes of payload
> (2021-05-10 17:09:47): [kcm] [queue_removal_cb] (0x0200): Removed queue for 1001
> (2021-05-10 17:09:47): [kcm] [kcm_send] (0x2000): All data sent!
> (2021-05-10 17:09:47): [kcm] [kcm_input_parse] (0x1000): Received message with length 9
> (2021-05-10 17:09:47): [kcm] [kcm_get_opt] (0x2000): The client requested operation 8
> (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x0400): KCM operation GET_PRINCIPAL
> (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x1000): 5 bytes on KCM input
> (2021-05-10 17:09:47): [kcm] [kcm_op_queue_send] (0x0200): Adding request by 1001 to the wait queue
> (2021-05-10 17:09:47): [kcm] [kcm_op_queue_get] (0x1000): No existing queue for this ID
> (2021-05-10 17:09:47): [kcm] [kcm_op_queue_send] (0x1000): Queue was empty, running the request immediately
> (2021-05-10 17:09:47): [kcm] [kcm_op_get_principal_send] (0x1000): Requested principal 1001
> (2021-05-10 17:09:47): [kcm] [ccdb_secdb_getbyname_send] (0x2000): Getting ccache by name
> (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/
> (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/ccache/]
> (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/ccache/] is [cn=ccache,cn=1001,cn=persistent,cn=kcm]
> (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/ccache/
> (2021-05-10 17:09:47): [kcm] [secdb_container_url_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/
> (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x0400): Listing keys at [persistent/1001/ccache/]
> (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=ccache,cn=1001,cn=persistent,cn=kcm] with scope=subtree
> (2021-05-10 17:09:47): [kcm] [local_dn_to_path] (0x2000): Secrets path for [cn=5005e896-bdfb-4116-8a11-eedacad1fa5b-1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] is [5005e896-
> bdfb-4116-8a11-eedacad1fa5b-1001]
> (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x1000): Returning 1 secrets
> (2021-05-10 17:09:47): [kcm] [key_by_name] (0x2000): Found key 5005e896-bdfb-4116-8a11-eedacad1fa5b-1001
> (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/
> (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001]
> (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001] is [cn=5005e896-bdfb-4116-8a11-
> eedacad1fa5b-1001,cn=ccache,cn=1001,cn=persistent,cn=kcm]
> (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001
> (2021-05-10 17:09:47): [kcm] [secdb_cc_url_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001
> (2021-05-10 17:09:47): [kcm] [secdb_cc_key_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001
> (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x0400): Retrieving a secret from [persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001]
> (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=5005e896-bdfb-4116-8a11-eedacad1fa5b-
> 1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] with scope=base
> (2021-05-10 17:09:47): [kcm] [secdb_get_cc] (0x2000): Fetched the ccache
> (2021-05-10 17:09:47): [kcm] [ccdb_secdb_getbyname_send] (0x2000): Got ccache by name
> (2021-05-10 17:09:47): [kcm] [kcm_cmd_done] (0x0400): KCM operation GET_PRINCIPAL returned [0]: Success
> (2021-05-10 17:09:47): [kcm] [kcm_send_reply] (0x2000): Sending a reply
> (2021-05-10 17:09:47): [kcm] [kcm_output_construct] (0x1000): Sending a reply with 37 bytes of payload
> (2021-05-10 17:09:47): [kcm] [queue_removal_cb] (0x0200): Removed queue for 1001
> (2021-05-10 17:09:47): [kcm] [kcm_send] (0x2000): All data sent!
> (2021-05-10 17:09:47): [kcm] [kcm_input_parse] (0x1000): Received message with length 9
> (2021-05-10 17:09:47): [kcm] [kcm_get_opt] (0x2000): The client requested operation 8
> (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x0400): KCM operation GET_PRINCIPAL
> (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x1000): 5 bytes on KCM input
> (2021-05-10 17:09:47): [kcm] [kcm_op_queue_send] (0x0200): Adding request by 1001 to the wait queue
> (2021-05-10 17:09:47): [kcm] [kcm_op_queue_get] (0x1000): No existing queue for this ID
> (2021-05-10 17:09:47): [kcm] [kcm_op_queue_send] (0x1000): Queue was empty, running the request immediately
> (2021-05-10 17:09:47): [kcm] [kcm_op_get_principal_send] (0x1000): Requested principal 1001
> (2021-05-10 17:09:47): [kcm] [ccdb_secdb_getbyname_send] (0x2000): Getting ccache by name
> (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/
> (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/ccache/]
> (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/ccache/] is [cn=ccache,cn=1001,cn=persistent,cn=kcm]
> (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/ccache/
> (2021-05-10 17:09:47): [kcm] [secdb_container_url_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/
> (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x0400): Listing keys at [persistent/1001/ccache/]
> (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=ccache,cn=1001,cn=persistent,cn=kcm] with scope=subtree
> (2021-05-10 17:09:47): [kcm] [local_dn_to_path] (0x2000): Secrets path for [cn=5005e896-bdfb-4116-8a11-eedacad1fa5b-1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] is [5005e896-
> bdfb-4116-8a11-eedacad1fa5b-1001]
> (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x1000): Returning 1 secrets
> (2021-05-10 17:09:47): [kcm] [key_by_name] (0x2000): Found key 5005e896-bdfb-4116-8a11-eedacad1fa5b-1001
> (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/
> (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001]
> (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001] is [cn=5005e896-bdfb-4116-8a11-
> eedacad1fa5b-1001,cn=ccache,cn=1001,cn=persistent,cn=kcm]
> (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001
> (2021-05-10 17:09:47): [kcm] [secdb_cc_url_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001
> (2021-05-10 17:09:47): [kcm] [secdb_cc_key_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001
> (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x0400): Retrieving a secret from [persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001]
> (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=5005e896-bdfb-4116-8a11-eedacad1fa5b-
> 1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] with scope=base
> (2021-05-10 17:09:47): [kcm] [secdb_get_cc] (0x2000): Fetched the ccache
> (2021-05-10 17:09:47): [kcm] [ccdb_secdb_getbyname_send] (0x2000): Got ccache by name
> (2021-05-10 17:09:47): [kcm] [kcm_cmd_done] (0x0400): KCM operation GET_PRINCIPAL returned [0]: Success
> (2021-05-10 17:09:47): [kcm] [kcm_send_reply] (0x2000): Sending a reply
> (2021-05-10 17:09:47): [kcm] [kcm_output_construct] (0x1000): Sending a reply with 37 bytes of payload
> (2021-05-10 17:09:47): [kcm] [queue_removal_cb] (0x0200): Removed queue for 1001
> (2021-05-10 17:09:47): [kcm] [kcm_send] (0x2000): All data sent!
> (2021-05-10 17:09:47): [kcm] [kcm_input_parse] (0x1000): Received message with length 132
> (2021-05-10 17:09:47): [kcm] [kcm_get_opt] (0x2000): The client requested operation 7
> (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x0400): KCM operation RETRIEVE
> (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x1000): 128 bytes on KCM input
> (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x0020): KCM op RETRIEVE has no handler
> (2021-05-10 17:09:47): [kcm] [kcm_cmd_request_done] (0x0040): KCM operation failed [1432158292]: KCM operation not implemented
> (2021-05-10 17:09:47): [kcm] [kcm_reply_error] (0x0040): KCM operation returns failure [1432158292]: KCM operation not implemented
> (2021-05-10 17:09:47): [kcm] [kcm_failbuf_construct] (0x1000): Sent reply with error -1765328137
> (2021-05-10 17:09:47): [kcm] [kcm_send] (0x2000): All data sent!
> (2021-05-10 17:09:47): [kcm] [kcm_recv] (0x4000): Client closed connection.
> (2021-05-10 17:09:47): [kcm] [client_close_fn] (0x2000): Terminated client [0x56377e20ead0][14]
>
>
> _______________________________________________
> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahoste...
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
>
3 years
AD user attribute refresh interval
by Ronald Wimmer
Today I had a web session with some collegues trying to log in with an
AD user on an IPA client system. We found out that the user account was
expired. After having reactivated that particular user we still saw "AD
user account expired" in the SSSD logs of that system. Which settings
can I use on the SSSD side (when a user is expired, locked, changes its
password, etc.) in order to get AD user attribute changes reflected
immediately on the FreeIPA side.
Cheers,
Ronald
3 years
Announcing SSSD 2.5.0
by Pavel Březina
# SSSD 2.5.0
The SSSD team is proud to announce the release of version 2.5.0 of the
System Security Services Daemon. The tarball can be downloaded from:
https://github.com/SSSD/sssd/releases/tag/2.5.0
See the full release notes at:
https://sssd.io/release-notes/sssd-2.5.0.html
RPM packages will be made available for Fedora shortly.
## Feedback
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
## Highlights
### General information
* `secrets` support is deprecated and will be removed in one of the next
versions of SSSD.
* `local-provider` is deprecated and will be removed in one of the next
versions of SSSD.
* SSSD's implementation of `libwbclient` was removed as incompatible
with modern version of Samba.
* This release deprecates `pcre1` support. This support will be removed
completely in following releases.
* A home directory from a dedicated user override, either local or
centrally managed by IPA, will have a higher precedence than the
`override_homedir` option.
* `debug-to-files`, `debug-to-stderr` command line and undocumented
`debug_to_files` config options were removed.
### New features
* Added support for automatic renewal of renewable TGTs that are stored
in KCM ccache. This can be enabled by setting `tgt_renewal = true`. See
the sssd-kcm man page for more details. This feature requires MIT
Kerberos krb5-1.19-0.beta2.3 or higher.
* Backround sudo periodic tasks (smart and full refresh) periods are now
extended by a random offset to spread the load on the server in
environments with many clients. The random offset can be changed with
`ldap_sudo_random_offset`.
* Completing a sudo full refresh now postpones the smart refresh by
`ldap_sudo_smart_refresh_interval` value. This ensure that the smart
refresh is not run too soon after a successful full refresh.
* If `debug_backtrace_enabled` is set to `true` then on any error all
prior debug messages (to some limit) are printed even if `debug_level`
is set to low value (for details see `man sssd.conf`:
`debug_backtrace_enabled` description).
* Besides trusted domains known by the forest root, trusted domains
known by the local domain are used as well.
* New configuration option `offline_timeout_random_offset` to control
random factor in backend probing interval when SSSD is in offline mode.
### Important fixes
* `ad_gpo_implicit_deny` is now respected even if there are no
applicable GPOs present
* During the IPA subdomains request a failure in reading a single
specific configuration option is not considered fatal and the request
will continue
* unknown IPA id-range types are not considered as an error
* SSSD spec file `%postun` no longer tries to restart services that can
not be restarted directly to stop produce systemd warnings
### Configuration changes
* Added `tgt_renewal`, `tgt_renewal_inherit`, and `krb5_*` KCM options
to enable, and tune behavior of new KCM renewal feature.
* Added `ldap_sudo_random_offset` (default to `30`) to add a random
offset to backround sudo periodic tasks (smart and full refresh).
* Introduced new option 'debug_backtrace_enabled' to control debug
backtrace.
* Added `offline_timeout_random_offset` configuration option to control
maximum size of random offset added to offline timeout SSSD backend
probing interval.
* Long time deprecated and undocumented `debug_to_files` option was removed.
3 years
Re: Problem with Client Installs on Centos 7
by Rob Crittenden
Please keep responses on the list.
Scott Reed wrote:
> Hi Rob,
>
>
>
> The FreeIPA accounts are using LDAP for logins to clients, right?
> That’s what I’ve understood. Is that wrong?
SSSD uses the host keytab to authenticate so if Kerberos isn't working
then that would be affected.
> The reason that I am forcing Kerberos realm is that the discovery does
> not properly configure the krb5.conf, and it fails because it says it
> can’t contact the KDC for the Realm. Once I configure krb5.conf with
> the missing parameters, it works fine. I use kinit and it finds the
> real fine.
It's failing because KDC discovery (dns_lookup_kdc) is true in your
final krb5.conf and since it can't be looked up, things fail. You're
probably missing the Kerberos TXT record.
I assume this doesn't return your realm:
$ dig +short -t TXT _kerberos.example.test.
rob
>
>
>
> Thanks,
>
>
>
> Scott Reed
>
>
>
> *From: *Rob Crittenden <mailto:rcritten@redhat.com>
> *Sent: *Friday, May 7, 2021 6:23 PM
> *To: *FreeIPA users list <mailto:freeipa-users@lists.fedorahosted.org>
> *Cc: *Steve Reed <mailto:scottmreed@hotmail.com>
> *Subject: *Re: [Freeipa-users] Problem with Client Installs on Centos 7
>
>
>
> Steve Reed via FreeIPA-users wrote:
>> Hi all,
>>
>> I am running Versions 4.8 of the client installations. I have one
> machine that installed except it failed to configure the krb5.conf file
> properly and it fails saying that it can't find the KDC for the realm
> xyz.com. I can fix Kerberos by manually editing the kfb5.conf file.
> Except for the rest of the machines which won't work for ldap logins,
> but Kerberos works fine.
>>
>> Prior to the installation, I make sure the resolv.conf file is
> configured properly. I make sure that the /etc/hosts file has the
> proper entries for the machine I am installing on and the server. No
> extraneous domain names. Also, I make sure the hostname is fully
> qualified with the domain name. I turn off any potential firewalld,
> iptables or ip6tables services as well.
>>
>> This is the installation command:
>>
>> ipa-client-install --mkhomedir -p admin -w PassWord@12345!
> --ntp-server=idm.xyz.com --unattended --force-join --realm XYZ.COM
>>
>>
>> 2021-05-07T20:36:19Z DEBUG Logging to /var/log/ipaclient-install.log
>> 2021-05-07T20:36:19Z DEBUG ipa-client-install was invoked with
> arguments [] and options: {'no_dns_sshfp': False, 'force': False,
> 'verbose': False, 'ip_addresses': None, 'configure_firefox': False,
> 'realm_name': 'XYZ.COM', 'force_ntpd': False, 'on_master': False,
> 'no_nisdomain': False, 'ssh_trust_dns': False, 'principal': 'admin',
> 'keytab': None, 'no_ntp': False, 'domain_name': None, 'request_cert':
> False, 'fixed_primary': False, 'no_ac': False, 'no_sudo': False,
> 'ca_cert_files': None, 'all_ip_addresses': False, 'kinit_attempts':
> None, 'ntp_servers': ['idm.xyz.com'], 'enable_dns_updates': False,
> 'no_sshd': False, 'no_sssd': False, 'no_krb5_offline_passwords': False,
> 'servers': None, 'no_ssh': False, 'force_join': True, 'firefox_dir':
> None, 'unattended': True, 'quiet': False, 'nisdomain': None,
> 'prompt_password': False, 'host_name': None, 'permit': False,
> 'automount_location': None, 'preserve_sssd': False, 'mkhomedir': True,
> 'log_file': None, 'uninstall': False}
>> 2021-05-07T20:36:19Z DEBUG IPA version 4.6.8-5.el7.centos
>> 2021-05-07T20:36:19Z DEBUG Loading Index file from
> '/var/lib/ipa-client/sysrestore/sysrestore.index'
>> 2021-05-07T20:36:19Z DEBUG Starting external process
>> 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/selinuxenabled
>> 2021-05-07T20:36:19Z DEBUG Process finished, return code=0
>> 2021-05-07T20:36:19Z DEBUG stdout=
>> 2021-05-07T20:36:19Z DEBUG stderr=
>> 2021-05-07T20:36:19Z DEBUG Starting external process
>> 2021-05-07T20:36:19Z DEBUG args=/bin/systemctl is-enabled chronyd.service
>> 2021-05-07T20:36:19Z DEBUG Process finished, return code=0
>> 2021-05-07T20:36:19Z DEBUG stdout=enabled
>>
>> 2021-05-07T20:36:19Z DEBUG stderr=
>> 2021-05-07T20:36:19Z DEBUG [IPA Discovery]
>> 2021-05-07T20:36:19Z DEBUG Starting IPA discovery with domain=None,
> servers=None, hostname=client1.xyz.com
>> 2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in
> "xyz.com" (domain of the hostname) and its sub-domains
>> 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _ldap._tcp.xyz.com
>> 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389 idm.xyz.com.
>> 2021-05-07T20:36:19Z DEBUG [Kerberos realm search]
>> 2021-05-07T20:36:19Z DEBUG Kerberos realm forced
>> 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of
> _kerberos._udp.xyz.com
>> 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 88 idm.xyz.com.
>> 2021-05-07T20:36:19Z DEBUG [LDAP server check]
>> 2021-05-07T20:36:19Z DEBUG Verifying that idm.xyz.com (realm XYZ.COM)
> is an IPA server
>> 2021-05-07T20:36:19Z DEBUG Init LDAP connection to: ldap://idm.xyz.com:389
>> 2021-05-07T20:36:19Z DEBUG Search LDAP server for IPA base DN
>> 2021-05-07T20:36:19Z DEBUG Check if naming context 'dc=xyz,dc=com' is
> for IPA
>> 2021-05-07T20:36:19Z DEBUG Naming context 'dc=xyz,dc=com' is a valid
> IPA context
>> 2021-05-07T20:36:19Z DEBUG Search for (objectClass=krbRealmContainer)
> in dc=xyz,dc=com (sub)
>> 2021-05-07T20:36:19Z DEBUG Found: cn=XYZ.COM,cn=kerberos,dc=xyz,dc=com
>> 2021-05-07T20:36:19Z DEBUG Discovery result: Success;
> server=idm.xyz.com, domain=xyz.com, kdc=idm.xyz.com, basedn=dc=xyz,dc=com
>> 2021-05-07T20:36:19Z DEBUG Validated servers: idm.xyz.com
>> 2021-05-07T20:36:19Z DEBUG will use discovered domain: xyz.com
>> 2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in
> "xyz.com" (Validating DNS Discovery) and its sub-domains
>> 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _ldap._tcp.xyz.com
>> 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389 idm.xyz.com.
>> 2021-05-07T20:36:19Z DEBUG DNS validated, enabling discovery
>> 2021-05-07T20:36:19Z DEBUG will use discovered server: idm.xyz.com
>> 2021-05-07T20:36:19Z INFO Discovery was successful!
>> 2021-05-07T20:36:19Z DEBUG will use discovered realm: XYZ.COM
>> 2021-05-07T20:36:19Z DEBUG will use discovered basedn: dc=xyz,dc=com
>> 2021-05-07T20:36:19Z INFO Client hostname: client1.xyz.com
>> 2021-05-07T20:36:19Z DEBUG Hostname source: Machine's FQDN
>> 2021-05-07T20:36:19Z INFO Realm: XYZ.COM
>> 2021-05-07T20:36:19Z DEBUG Realm source: Discovered from LDAP DNS
> records in idm.xyz.com
>> 2021-05-07T20:36:19Z INFO DNS Domain: xyz.com
>> 2021-05-07T20:36:19Z DEBUG DNS Domain source: Discovered LDAP SRV
> records from xyz.com (domain of the hostname)
>> 2021-05-07T20:36:19Z INFO IPA Server: idm.xyz.com
>> 2021-05-07T20:36:19Z DEBUG IPA Server source: Discovered from LDAP DNS
> records in idm.xyz.com
>> 2021-05-07T20:36:19Z INFO BaseDN: dc=xyz,dc=com
>> 2021-05-07T20:36:19Z DEBUG BaseDN source: From IPA server
> ldap://idm.xyz.com:389
>> 2021-05-07T20:36:19Z DEBUG Loading Index file from
> '/var/lib/ipa-client/sysrestore/sysrestore.index'
>> 2021-05-07T20:36:19Z DEBUG Loading StateFile from
> '/var/lib/ipa-client/sysrestore/sysrestore.state'
>> 2021-05-07T20:36:19Z DEBUG Starting external process
>> 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-rmkeytab -k
> /etc/krb5.keytab -r XYZ.COM
>> 2021-05-07T20:36:19Z DEBUG Process finished, return code=5
>> 2021-05-07T20:36:19Z DEBUG stdout=
>> 2021-05-07T20:36:19Z DEBUG stderr=realm not found
>>
>> 2021-05-07T20:36:19Z INFO Skipping synchronizing time with NTP server.
>> 2021-05-07T20:36:19Z DEBUG Starting external process
>> 2021-05-07T20:36:19Z DEBUG args=/usr/bin/keyctl get_persistent @s 0
>> 2021-05-07T20:36:19Z DEBUG Process finished, return code=0
>> 2021-05-07T20:36:19Z DEBUG stdout=599779671
>>
>> 2021-05-07T20:36:19Z DEBUG stderr=
>> 2021-05-07T20:36:19Z DEBUG Enabling persistent keyring CCACHE
>> 2021-05-07T20:36:19Z DEBUG Writing Kerberos configuration to
> /tmp/tmpfFCY1T:
>> 2021-05-07T20:36:19Z DEBUG #File modified by ipa-client-install
>>
>> includedir /etc/krb5.conf.d/
>> includedir /var/lib/sss/pubconf/krb5.include.d/
>>
>> [libdefaults]
>> default_realm = XYZ.COM
>> dns_lookup_realm = false
>> dns_lookup_kdc = false
>> rdns = false
>> dns_canonicalize_hostname = false
>> ticket_lifetime = 24h
>> forwardable = true
>> udp_preference_limit = 0
>> default_ccache_name = KEYRING:persistent:%{uid}
>>
>>
>> [realms]
>> XYZ.COM = {
>> kdc = idm.xyz.com:88
>> master_kdc = idm.xyz.com:88
>> admin_server = idm.xyz.com:749
>> kpasswd_server = idm.xyz.com:464
>> default_domain = xyz.com
>> pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
>> pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
>>
>> }
>>
>>
>> [domain_realm]
>> .xyz.com = XYZ.COM
>> xyz.com = XYZ.COM
>> client1.xyz.com = XYZ.COM
>>
>>
>>
>> 2021-05-07T20:36:19Z DEBUG Initializing principal admin(a)XYZ.COM using
> password
>> 2021-05-07T20:36:19Z DEBUG Starting external process
>> 2021-05-07T20:36:19Z DEBUG args=/usr/bin/kinit admin(a)XYZ.COM -c
> /tmp/krbccnj9ncO/ccache
>> 2021-05-07T20:36:19Z DEBUG Process finished, return code=0
>> 2021-05-07T20:36:19Z DEBUG stdout=Password for admin(a)XYZ.COM:
>>
>> 2021-05-07T20:36:19Z DEBUG stderr=
>> 2021-05-07T20:36:19Z DEBUG trying to retrieve CA cert via LDAP from
> idm.xyz.com
>> 2021-05-07T20:36:19Z DEBUG retrieving schema for SchemaCache
> url=ldap://idm.xyz.com:389 conn=<ldap.ldapobject.SimpleLDAPObject
> instance at 0x7fc3c40d7248>
>> 2021-05-07T20:36:19Z INFO Successfully retrieved CA cert
>> Subject: CN=Certificate Authority,O=XYZ.COM
>> Issuer: CN=Certificate Authority,O=XYZ.COM
>> Valid From: 2021-05-06 19:54:28
>> Valid Until: 2041-05-06 19:54:28
>>
>> 2021-05-07T20:36:19Z DEBUG Starting external process
>> 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-join -s idm.xyz.com -b
> dc=xyz,dc=com -h client1.xyz.com -f
>> 2021-05-07T20:36:20Z DEBUG Process finished, return code=0
>> 2021-05-07T20:36:20Z DEBUG stdout=
>> 2021-05-07T20:36:20Z DEBUG stderr=Keytab successfully retrieved and
> stored in: /etc/krb5.keytab
>> Certificate subject base is: O=XYZ.COM
>>
>> 2021-05-07T20:36:20Z INFO Enrolled in IPA realm XYZ.COM
>> 2021-05-07T20:36:20Z DEBUG Starting external process
>> 2021-05-07T20:36:20Z DEBUG args=/usr/bin/kdestroy
>> 2021-05-07T20:36:20Z DEBUG Process finished, return code=0
>> 2021-05-07T20:36:20Z DEBUG stdout=
>> 2021-05-07T20:36:20Z DEBUG stderr=
>> 2021-05-07T20:36:20Z DEBUG Initializing principal
> host/client1.xyz.com(a)XYZ.COM using keytab /etc/krb5.keytab
>> 2021-05-07T20:36:20Z DEBUG using ccache /etc/ipa/.dns_ccache
>> 2021-05-07T20:36:20Z DEBUG Attempt 1/5: success
>> 2021-05-07T20:36:20Z DEBUG Backing up system configuration file
> '/etc/ipa/default.conf'
>> 2021-05-07T20:36:20Z DEBUG -> Not backing up -
> '/etc/ipa/default.conf' doesn't exist
>> 2021-05-07T20:36:20Z INFO Created /etc/ipa/default.conf
>> 2021-05-07T20:36:20Z DEBUG Backing up system configuration file
> '/etc/sssd/sssd.conf'
>> 2021-05-07T20:36:20Z DEBUG Saving Index File to
> '/var/lib/ipa-client/sysrestore/sysrestore.index'
>> 2021-05-07T20:36:20Z DEBUG Backing up system configuration file
> '/etc/nsswitch.conf'
>> 2021-05-07T20:36:20Z DEBUG Saving Index File to
> '/var/lib/ipa-client/sysrestore/sysrestore.index'
>> 2021-05-07T20:36:20Z INFO Configured sudoers in /etc/nsswitch.conf
>> 2021-05-07T20:36:20Z INFO Configured /etc/sssd/sssd.conf
>> 2021-05-07T20:36:20Z DEBUG Backing up system configuration file
> '/etc/krb5.conf'
>> 2021-05-07T20:36:20Z DEBUG Saving Index File to
> '/var/lib/ipa-client/sysrestore/sysrestore.index'
>> 2021-05-07T20:36:20Z DEBUG Starting external process
>> 2021-05-07T20:36:20Z DEBUG args=/usr/bin/keyctl get_persistent @s 0
>> 2021-05-07T20:36:20Z DEBUG Process finished, return code=0
>> 2021-05-07T20:36:20Z DEBUG stdout=599779671
>>
>> 2021-05-07T20:36:20Z DEBUG stderr=
>> 2021-05-07T20:36:20Z DEBUG Enabling persistent keyring CCACHE
>> 2021-05-07T20:36:20Z DEBUG Writing Kerberos configuration to
> /etc/krb5.conf:
>> 2021-05-07T20:36:20Z DEBUG #File modified by ipa-client-install
>>
>> includedir /etc/krb5.conf.d/
>> includedir /var/lib/sss/pubconf/krb5.include.d/
>>
>> [libdefaults]
>> default_realm = XYZ.COM
>> dns_lookup_realm = true
>> dns_lookup_kdc = true
>> rdns = false
>> dns_canonicalize_hostname = false
>> ticket_lifetime = 24h
>> forwardable = true
>> udp_preference_limit = 0
>> default_ccache_name = KEYRING:persistent:%{uid}
>>
>>
>> [realms]
>> XYZ.COM = {
>> pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
>> pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
>>
>> }
>>
>>
>> [domain_realm]
>> .xyz.com = XYZ.COM
>> xyz.com = XYZ.COM
>> client1.xyz.com = XYZ.COM
>>
>>
>>
>> 2021-05-07T20:36:20Z INFO Configured /etc/krb5.conf for IPA realm XYZ.COM
>> 2021-05-07T20:36:20Z DEBUG Starting external process
>> 2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d
> dbm:/tmp/tmpxItqiM -N -f /tmp/tmpxItqiM/pwdfile.txt -f
> /tmp/tmpxItqiM/pwdfile.txt
>> 2021-05-07T20:36:20Z DEBUG Process finished, return code=0
>> 2021-05-07T20:36:20Z DEBUG stdout=
>> 2021-05-07T20:36:20Z DEBUG stderr=
>> 2021-05-07T20:36:20Z DEBUG Starting external process
>> 2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d
> dbm:/tmp/tmpxItqiM -A -n CA certificate 1 -t C,, -a -f
> /tmp/tmpxItqiM/pwdfile.txt
>> 2021-05-07T20:36:20Z DEBUG Process finished, return code=0
>> 2021-05-07T20:36:20Z DEBUG stdout=
>> 2021-05-07T20:36:20Z DEBUG stderr=
>> 2021-05-07T20:36:20Z DEBUG failed to find session_cookie in persistent
> storage for principal 'host/client1.xyz.com(a)XYZ.COM'
>> 2021-05-07T20:36:20Z INFO trying https://idm.xyz.com/ipa/json
>> 2021-05-07T20:36:20Z DEBUG Created connection
> context.rpcclient_140479019423504
>> 2021-05-07T20:36:20Z INFO [try 1]: Forwarding 'schema' to json server
> 'https://idm.xyz.com/ipa/json'
>> 2021-05-07T20:36:20Z DEBUG New HTTP connection (idm.xyz.com)
>> 2021-05-07T20:36:20Z DEBUG HTTP connection destroyed (idm.xyz.com)
>> Traceback (most recent call last):
>> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in
> single_request
>> self.get_auth_info()
>> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in
> get_auth_info
>> self._handle_exception(e, service=service)
>> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in
> _handle_exception
>> raise errors.KerberosError(message=unicode(e))
>> KerberosError: Major (851968): Unspecified GSS failure. Minor code
> may provide more information, Minor (2529639068): Cannot contact any KDC
> for realm 'XYZ.COM'
>> 2021-05-07T20:36:20Z DEBUG Destroyed connection
> context.rpcclient_140479019423504
>> 2021-05-07T20:36:20Z DEBUG File
> "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in
> execute
>> return_value = self.run()
>> File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py",
> line 319, in run
>> return cfgr.run()
>> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
> line 360, in run
>> return self.execute()
>> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
> line 386, in execute
>> for rval in self._executor():
>> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
> line 431, in __runner
>> exc_handler(exc_info)
>> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
> line 460, in _handle_execute_exception
>> self._handle_exception(exc_info)
>> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
> line 450, in _handle_exception
>> six.reraise(*exc_info)
>> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
> line 421, in __runner
>> step()
>> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
> line 418, in <lambda>
>> step = lambda: next(self.__gen)
>> File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
> line 81, in run_generator_with_yield_from
>> six.reraise(*exc_info)
>> File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
> line 59, in run_generator_with_yield_from
>> value = gen.send(prev_value)
>> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
> line 655, in _configure
>> next(executor)
>> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
> line 431, in __runner
>> exc_handler(exc_info)
>> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
> line 460, in _handle_execute_exception
>> self._handle_exception(exc_info)
>> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
> line 518, in _handle_exception
>> self.__parent._handle_exception(exc_info)
>> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
> line 450, in _handle_exception
>> six.reraise(*exc_info)
>> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
> line 515, in _handle_exception
>> super(ComponentBase, self)._handle_exception(exc_info)
>> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
> line 450, in _handle_exception
>> six.reraise(*exc_info)
>> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
> line 421, in __runner
>> step()
>> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
> line 418, in <lambda>
>> step = lambda: next(self.__gen)
>> File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
> line 81, in run_generator_with_yield_from
>> six.reraise(*exc_info)
>> File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
> line 59, in run_generator_with_yield_from
>> value = gen.send(prev_value)
>> File "/usr/lib/python2.7/site-packages/ipapython/install/common.py",
> line 65, in _install
>> for unused in self._installer(self.parent):
>> File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py",
> line 3670, in main
>> install(self)
>> File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py",
> line 2391, in install
>> _install(options)
>> File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py",
> line 2733, in _install
>> api.finalize()
>> File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line
> 740, in finalize
>> self.__do_if_not_done('load_plugins')
>> File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line
> 431, in __do_if_not_done
>> getattr(self, name)()
>> File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line
> 619, in load_plugins
>> for package in self.packages:
>> File "/usr/lib/python2.7/site-packages/ipalib/__init__.py", line
> 954, in packages
>> ipaclient.remote_plugins.get_package(self),
>> File
> "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/__init__.py",
> line 134, in get_package
>> plugins = schema.get_package(server_info, client)
>> File
> "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py",
> line 553, in get_package
>> schema = Schema(client)
>> File
> "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py",
> line 401, in __init__
>> fingerprint, ttl = self._fetch(client, ignore_cache=read_failed)
>> File
> "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py",
> line 426, in _fetch
>> schema = client.forward(u'schema', **kwargs)['result']
>> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1151, in
> forward
>> return self._call_command(command, params)
>> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1127, in
> _call_command
>> return command(*params)
>> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1281, in
> _call
>> return self.__request(name, args)
>> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1248, in
> __request
>> verbose=self.__verbose >= 3,
>> File "/usr/lib64/python2.7/xmlrpclib.py", line 1273, in request
>> return self.single_request(host, handler, request_body, verbose)
>> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in
> single_request
>> self.get_auth_info()
>> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in
> get_auth_info
>> self._handle_exception(e, service=service)
>> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in
> _handle_exception
>> raise errors.KerberosError(message=unicode(e))
>>
>> 2021-05-07T20:36:20Z DEBUG The ipa-client-install command failed,
> exception: KerberosError: Major (851968): Unspecified GSS failure.
> Minor code may provide more information, Minor (2529639068): Cannot
> contact any KDC for realm 'XYZ.COM'
>> 2021-05-07T20:36:20Z ERROR Major (851968): Unspecified GSS failure.
> Minor code may provide more information, Minor (2529639068): Cannot
> contact any KDC for realm 'XYZ.COM'
>> 2021-05-07T20:36:20Z ERROR The ipa-client-install command failed. See
> /var/log/ipaclient-install.log for more information
>>
>> So, what I found is that the krb5.conf file is partially configured.
> I'm not sure what to look for in the sssd.conf file. I am assuming that
> since I can't login with an ldap account and it finds the domain that
> something is not cofigured properly for that either.
>>
>> Any thoughts on what is going wrong? And how I can fix it or work
> around it? I'm more worried about not being able to do ldap logins than
> the Kerberos problem since I have a work around for that.
>
> Can you expand on what you mean by ldap logins fail?
>
> Is there a reason you're forcing the Kerberos realm and not relying on
> discovery?
>
> rob
>
>
>
3 years
Solaris Public Key Authentication
by Mark Burgess
Hi,
we are integrating a number of Solaris 11 servers into our FreeIPA deployment. The solution requires SSH key based authentication for user access to the Solaris 11 servers. We have password authentication working correctly with FreeIPA using a proxy user (Solaris cllient) binding to a service account (FreeIPA server). Key based authentication keeps failing with the following message in the SSH server debug output:
mm_answer_keyallowed: publickey authentication test: RSA key is not allowed
The Solaris SSH setup has the following parameter setting:
AuthorizedKeysCommand /usr/lib/ssh/ssh-pubkey-ldap
..
The /usr/lib/ssh/ssh-pubkey-ldap command accepts the username attempting to login and basically runs a "ldapsearch list <<username>>" command that returns all the LDAP attributes for the user. From what I can tell, the Solaris LDAP client it is looking for the sshPublicKey OpenLDAP user attribute to obtain the users SSH public key. FreeIPA returns the ipaSshPubKey attribute for the user and we get a failed login message as per the above.
Has anyone had any success in using FreeIPA with Solaris and SSH public keys? I am not sure if we are looking in the correct place for the errors but from what we can see this is the most likely cause of the problem.
One thing we have tried is to map the LDAP attributes on Solaris when setting up the LDAP client. This does not seem to have made any difference however.
Thanks in advance.
Mark
3 years
