DNS - no paypal.com RSASHA1 ?
by lejeczek
Hi guys.
With latest IPA on CentOS 9, ver 4.9.8 &
bind-9.16.23-1.el9.x86_64 - what would be a correct
(temporary) workaround for those records around the world
which are signed with "oldish" crypts?
many thanks, L.
2 years, 2 months
Directory Manager automation
by Jim Kinney
I have the system set to use CRYPT-SHA512 as password store method. For antiquated reasons I need to generate a shadow file from data stored in freeipa.
I would greatly prefer to not have to use the cn=Directory Manager and use a different binddn. But it seems only the DM has the ability to actually retrieve userpasswd.
The pain point is the password entry. -y file doesn't work - ldap-bind: Invalid credentials (49). The stored password is correct and perms are 0600 and in /root. The DM is not in the kerberos database so I can't use a keytab and -YGSSAPI. The only method that works is the password entered on the cli.
Ugh. That is unpleasant.
This needs to run on a systemd timer to autogenerate the shadow file (and passwd and group files but those are easy) for a few thousand nodes that can't fail due to a network outage with freeipa (IdM actually). This is to handle user password changes and group membership changes in an HPC environment. I can dump in the passwd with expect. Just wondering if there's a way to setup a special password hash reading account with a keytab and not use the Directory Manager and password.
--
Computers amplify human error
Super computers are really cool
2 years, 2 months
Active Directory Certificate Services as a Subordinate CA under IPA
by Tyrell Jentink
I am primarily a Linux admin, and this might be a Windows problem... In
fact, this might not even be the right forum for me to be asking this
question, but I don't know which Windows forum would give me the time of
day, so I'm here... I might also try some Windows Reddit groups... :p The
following domain names are obscured to protect the wicked; I know not to
use fake domains ;)
I have an IPA server called dc.domain.local, an ActiveDirectory Directory
Server called pdc.win.domain.local, and a ActiveDirectory Certificate
Server called pki.win.domain.local. I am trying to configure the ADDS as a
subdomain of the IPA domain. I am using A and NS Records to delegate the
subdomain name. I am NOT attempting to create a interforest trust between
these two domains at this time (Although, as an aside, there will
eventually be another IPA server at pdc.lin.rxrhouse.net for subdomain
lin.domain.local, and THAT one will have an interforest trust with
win.rxrhouse.net; If IPA-IPA Trusts ever become a "thing", the top domain
will get trusts to both subdomains, but for now, pki.win.domain.local only
needs to 1) have a signed subordinate certificate from dc.domain.local, and
2) run). As I have been able to get it, ADCS seems to be installed with a
signed cert, but it won't run.
I installed ADCS as an Enterprise Subordinate CA; Based on
https://frasertweedale.github.io/blog-redhat/posts/2017-08-14-ad-cs.html, I
added win.domain.local as a host principal on IPA. I used that principal to
sign the CSR, which worked fine. I installed that certificate back to AD.
AD prompted for the Root Certificate, which I provided, and AD warned that
it couldn't verify the chain of trust because it couldn't contact a CRL.
But now ADCS won't start... Every time I try to start it, it complains,
again, that it can't reach a CRL.
In Windows Server Manager, in Certificate Authority manager (CertSrv),
right click on the CA tree, under Properties... I see that all of the CRL
Distribution Points (CDPs) and AIAs are their default, non-configured
forms... It's my crude guess that I need to be pointing those values to
IPA? The example is of the form
http://<ServerDNSName>/CertEnroll/<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl,
if that hint prompts anyone's thinking...
Even if you have a suggestion of another forum to ask this on, I'm all
ears. Thank you for your assistance!
--
Tyrell Jentink
2 years, 2 months
sudo rules and globbing
by Djerk Geurts
This is a topic that I've spent way too much time on recently. The reason is I'm trying to manage sudo rights for teams and the sudo ruleset is getting out of hand as no globs I've tried are working except for maybe an '*' in a pathname. I'm trying to keep things secure I'd like to allow members of a certain group to manage the services they're responsible for. These are dev guys so there's a fair bit of management involved.
Initially, I would create a rule for systemctl start, another for stop, etc for status, reload and restart. Then I have to add the journalctl rules for seeing the current logs and the tail options for those.
In trying to make thing easier when adding rules, and knowing glob should be supported I was hoping to simplify things to:
/usr/bin/journalctl --unit nodejs@+([a-zA-Z]) @(-t)
/usr/bin/systemctl (start|stop|status|reload|restart) nodejs@+([a-zA-Z])
But alas, none of this is working, what does work is a long list of rules specific to each separate instantiated service, which is getting really tiresome and error-prone. Is there anything I can do to ease maintaining these rules, or do I give up and look at using Ansible to automate FreeIPA sudo rules?
2 years, 2 months
Re: sudo rules and globbing
by Djerk Geurts
Hi Angus,
I’ve seen the suggestion, but the issue with that would be having to train people on different commands, and me having to write custom scripts. I’m trying avoid further customisation, instead training people how to use systems rather than run services under personal accounts or needlessly as root. It’s a tough call to then turn around and say that it’s okay to run my custom script because there’s no centralised way of managing things. See these scripts would then also need to be deployed to these systems and maintained.
When I issue 'sudo -l’ I see the rules parsed as configured in FreeIPA, which confirms Rob’s point of how the rules are read by sudo. I’m going to have a go at creating some local rules to see if I can use wildcards there.
Failing that it’ll be a CI/CD workflow to deploy a shudders file to /etc/sudoers.d/ And then reference the Cmnd_Alias in a FreeIPA rule. All stuff that introduces more potential issues, but both alternatives are too extreme (my time, versus a complete lack of security).
Thanks,
Djerk
> On 22 Mar 2022, at 16:45, Angus Clarke <angus(a)charworth.com> wrote:
>
> Hi Djerk
>
> Alternatively, you could write/deploy wrapper scripts to run the commands you want.
>
> Regards
> Angus
>
> From: Djerk Geurts via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
>
> > On 22 Mar 2022, at 15:42, Rob Crittenden <rcritten(a)redhat.com> wrote:
> >
> > Djerk Geurts via FreeIPA-users wrote:
> >> This is a topic that I've spent way too much time on recently. The reason is I'm trying to manage sudo rights for teams and the sudo ruleset is getting out of hand as no globs I've tried are working except for maybe an '*' in a pathname. I'm trying to keep things secure I'd like to allow members of a certain group to manage the services they're responsible for. These are dev guys so there's a fair bit of management involved.
> >>
> >> Initially, I would create a rule for systemctl start, another for stop, etc for status, reload and restart. Then I have to add the journalctl rules for seeing the current logs and the tail options for those.
> >>
> >> In trying to make thing easier when adding rules, and knowing glob should be supported I was hoping to simplify things to:
> >>
> >> /usr/bin/journalctl --unit nodejs@+([a-zA-Z]) @(-t)
> >> /usr/bin/systemctl (start|stop|status|reload|restart) nodejs@+([a-zA-Z])
> >>
> >> But alas, none of this is working, what does work is a long list of rules specific to each separate instantiated service, which is getting really tiresome and error-prone. Is there anything I can do to ease maintaining these rules, or do I give up and look at using Ansible to automate FreeIPA sudo rules?
> >
> > It may very well depend on the version of sudo you have on the client(s)
> > whether regular expressions are supported or not.
> >
> > IPA is only a container for the rules. It just passes them along to
> > sudo. I'd suggest checking with the sudo team as well.
> >
> > There may also be distribution-based idiosyncrasies.
> >
> > rob
>
> Thanks you, I’ll check there as well. It’s mostly Ubuntu 20.04 here with a few Debian 10 and CentOS 7 machines as well. So far I’ve seen no difference between them.
>
> Djerk
2 years, 2 months
Help request on FreeIPA and Linux Certicate of Authority renewal.
by Eric Boisvert
Hi,
We are looking for help on CA certificate renewal with FreeIPA under a Linux
environment. We went through most of the FreeIPA documentation available and
we couldnt fix our issue yet.
Is there an expert on this topic that could help us with this issue.
Best Regards,
Eric Boisvert
Directeur des Opérations/Operation Manager
LR Tech inc.
3945 Boul. Guillaume-Couture
Lévis (Québec) G6W 1H6
Canada
Tél: (418) 907-1661
Mobile: (581) 309-9279
<http://www.lrtech.ca/> www.lrtech.ca
____________________________________________________________________________
____________________________________________________________________________
__
Ce courriel (de même que les fichiers joints) est strictement réservé à
l'usage de la personne ou de l'entité à qui il est adressé et peut contenir
de l'information privilégiée et confidentielle. Toute divulgation,
distribution ou copie de ce courriel est strictement prohibée.
Si vous avez reçu ce courriel par erreur, veuillez nous en aviser
sur-le-champ, détruire toutes les copies et le supprimer de votre système
informatique.
2 years, 2 months
Right intermediate CA path
by sodd＠email.cz
Hi, first i would like to thank you all for your great work on FreeIPA!
I'm having problem with how FreeIPA (installed with external CA) is creating
CA chain in wrong order (if I'm not wrong) according to RFC 5280 section
6.1. [1]. When I try to use /etc/ipa/ca.crt in 3th party web app the app
wont start until i fix the chain order.
So my questing is how to fix this wrong chain order gerenrated from ipa-
certupdate.
PS: I created test instance and made self sign CA and then intermediated CAs
to show how will FreeIPA construct the chain. And for this chain:
ROOTCA <- INTERCA-B <- INTERCA-C <- INTERCA-D <- INTERCA-E <- INTERCA-IPA
FreeIPA ipa-certupdate create this chain:
0: subject=CN = INTERCA-B
issuer=CN = ROOTCA
1: subject=CN = INTERCA-C
issuer=CN = INTERCA-B
2: subject=CN = INTERCA-D
issuer=CN = INTERCA-C
3: subject=CN = INTERCA-E
issuer=CN = INTERCA-D
4: subject=CN = ROOTCA
issuer=CN = ROOTCA
5: subject=CN = INTERCA-IPA
issuer=CN = INTERCA-E
Right order should be:
0: subject=CN = INTERCA-IPA
issuer=CN = INTERCA-E
1: subject=CN = INTERCA-E
issuer=CN = INTERCA-D
2: subject=CN = INTERCA-D
issuer=CN = INTERCA-C
3: subject=CN = INTERCA-C
issuer=CN = INTERCA-B
4: subject=CN = INTERCA-B
issuer=CN = ROOTCA
5: subject=CN = ROOTCA
issuer=CN = ROOTCA
Is there anything what I can do to fix this situation. Right now I'm
handling this situation with ipa-getcert request --after-command.
[1] - https://datatracker.ietf.org/doc/html/rfc5280#section-6.1
--
sodd(a)email.cz
2 years, 2 months
Add custom subentry to UID object.
by Jean Tomaz da Silva
Dears,
Is it possible to add a custom subentry to UID object without using the ldapmodifty tool? Using the ipa cli commands or through of the web ui.
My ldif file content is bellow.
dn: Affiliation=1,uid=john,cn=users,cn=accounts,dc=example,dc=com
changetype: add
Affiliation: 1
AffiliationType: employee
objectClass: CustomPerson
objectClass: top
Best regards,
Jean Tomaz
2 years, 2 months
IPA AD Authentication not successfull if using alernative logon domain
by Florian Wilhelm
We are successfully running a FreeIPA setup connected to an AD using kerberos to authenticate. (IPA is used as provider).
Our windows domain name is not identical to our main mail domain. For some users the User logon name in windows (the one with @ not the old pre-win2000 one) is using a domain name which has no kerberos servers etc. In windows authentication works perfectly, but in our IPA setup we run into a big issue.
No matter which domain the user chooses to authenticate against our linux servers, the linux server tries to authenticate against the kerberos servers of the domain which has no servers.
In the krb5.conf we manually configured the kerberos servers of the windows AD for this domain. Now we get [Realm not local to KDC] in the krb5_child.log.
Is there any way to forcefully replace the domain name when authenticating? We tried using auth_to_local without success so far.
2 years, 2 months
