From pspacek at redhat.com Mon Jul 1 06:50:02 2013 From: pspacek at redhat.com (Petr Spacek) Date: Mon, 01 Jul 2013 08:50:02 +0200 Subject: [Freeipa-users] Service...not found in Kerberos database In-Reply-To: <1464774.RA4R9SJAkZ@hosanna> References: <1464774.RA4R9SJAkZ@hosanna> Message-ID: <51D1269A.30101@redhat.com> On 29.6.2013 09:40, Joshua J. Kugler wrote: > We are trying to query an IPA server from a new IPA server (not replication, > just trying to query to recreate accounts). > > But, when I run the query, I get this: > > [root at ipan ~]# ipa -vvv -e xmlrpc_uri=https://ipa0.lab.whamcloud.com/ipa/xml > user-show jkugler > ipa: INFO: trying https://ipa0.lab.whamcloud.com/ipa/xml > ipa: INFO: Forwarding 'user_show' to server > u'https://ipa0.lab.whamcloud.com/ipa/xml' > ipa: ERROR: Service 'HTTP at ipa0.lab.whamcloud.com' not found in Kerberos > database > > I've done some googling, and what the answers I found had to do with DNS > issues, but I don't believe that is the cause in our case, due to DNS lookups > seeming to work. > > [root at ipan ~]# host ipan.lab.whamcloud.com > ipan.lab.whamcloud.com has address 10.10.0.50 > [root at ipan ~]# host ipa0.lab.whamcloud.com > ipa0.lab.whamcloud.com has address 10.10.0.4 > [root at ipan ~]# host 10.10.0.50 > 50.0.10.10.in-addr.arpa domain name pointer ipan.lab.whamcloud.com. > [root at ipan ~]# host 10.10.0.4 > 4.0.10.10.in-addr.arpa domain name pointer ipa0.lab.whamcloud.com. > > What config do I need to tweak on the new server to allow it to query the old > server? I guess that now you have two FreeIPA servers with different host names but with the same FreeIPA domain and Kerberos REALM name, right? Please correct me if I'm wrong. This configuration can't work with Kerberos authentication. Authentication to only one server will work at one time, because there is no reliable way how to find which KDC (old or new) you should query. IMHO the simplest way how to work around this situation is to generate list of users etc. on the 'old' server, save the data to a file and transfer files to the new server. (And then decommission the old server.) This will save you a pain caused by mis-configured Kerberos, but you will have to solve file parsing. -- Petr^2 Spacek From james.hogarth at gmail.com Mon Jul 1 07:56:23 2013 From: james.hogarth at gmail.com (James Hogarth) Date: Mon, 1 Jul 2013 08:56:23 +0100 Subject: [Freeipa-users] named seg faulting Message-ID: Hi all, We're seeing an odd issue where when rndc reload is called named segfaults but not 100% of the time ... so the exact circumstances are hard to reproduce although it happens on all four instances (sometime at the same time which is problematic). When it happens we see the following in the logs: Jun 30 03:07:02 ipa01 named[4228]: client 10.137.17.1#52842: received notify for zone 'example.com' Jun 30 03:07:03 ipa01 named[4228]: client 10.137.17.1#1131: received notify for zone '9.139.10.in-addr.arpa' Jun 30 03:07:03 ipa01 named[4228]: client 10.137.17.1#1131: received notify for zone 'dev.example.com' Jun 30 03:07:03 ipa01 named[4228]: client 10.137.17.1#1131: received notify for zone '8.139.10.in-addr.arpa' Jun 30 03:07:03 ipa01 named[4228]: client 10.137.17.1#1131: received notify for zone 'prod.example.com' Jun 30 03:07:03 ipa01 named[4228]: client 10.137.17.1#64362: received notify for zone '16.137.10.in-addr.arpa' Jun 30 03:07:03 ipa01 named[4228]: client 10.137.17.1#64362: received notify for zone '17.137.10.in-addr.arpa' Jun 30 03:07:03 ipa01 named[4228]: client 10.137.17.1#64362: received notify for zone '18.137.10.in-addr.arpa' Jun 30 03:07:03 ipa01 named[4228]: client 10.137.17.1#64362: received notify for zone '19.137.10.in-addr.arpa' Jun 30 03:07:07 ipa01 named[4228]: client 10.137.17.1#56263: received notify for zone '17.137.10.in-addr.arpa' Jun 30 03:07:08 ipa01 named[4228]: client 10.137.17.1#30345: received notify for zone '18.137.10.in-addr.arpa' Jun 30 03:07:08 ipa01 named[4228]: client 10.137.17.1#30345: received notify for zone '19.137.10.in-addr.arpa' Jun 30 03:10:01 ipa01 named[4228]: received control channel command 'reload' Jun 30 03:10:01 ipa01 named[4228]: loading configuration from '/etc/named.conf' Jun 30 03:10:01 ipa01 named[4228]: using default UDP/IPv4 port range: [1024, 65535] Jun 30 03:10:01 ipa01 named[4228]: using default UDP/IPv6 port range: [1024, 65535] Jun 30 03:10:01 ipa01 named[4228]: sizing zone task pool based on 6 zones Jun 30 03:10:01 ipa01 named[4228]: /etc/named.conf:12: no forwarders seen; disabling forwarding Jun 30 03:10:01 ipa01 named[4228]: Warning: 'empty-zones-enable/disable-empty-zone' not set: disabling RFC 1918 empty zones Jun 30 03:10:01 ipa01 named[4228]: /etc/named.conf:12: no forwarders seen; disabling forwarding Jun 30 03:10:01 ipa01 named[4228]: reloading configuration succeeded Jun 30 03:10:01 ipa01 named[4228]: reloading zones succeeded Jun 30 03:10:01 ipa01 named[4228]: task.c:1448: REQUIRE(task->state == task_state_running) failed, back trace Jun 30 03:10:01 ipa01 named[4228]: #0 0x7f1996e74eff in ?? Jun 30 03:10:01 ipa01 named[4228]: #1 0x7f199582589a in ?? Jun 30 03:10:01 ipa01 named[4228]: #2 0x7f1995843a8f in ?? Jun 30 03:10:01 ipa01 named[4228]: #3 0x7f19904df97f in ?? Jun 30 03:10:01 ipa01 named[4228]: #4 0x7f19904e0df3 in ?? Jun 30 03:10:01 ipa01 named[4228]: #5 0x7f19904e3e8c in ?? Jun 30 03:10:01 ipa01 named[4228]: #6 0x7f19951f9851 in ?? Jun 30 03:10:01 ipa01 named[4228]: #7 0x7f199475b90d in ?? Jun 30 03:10:01 ipa01 named[4228]: exiting (due to assertion failure) Has anyone else seen similar behaviour or have any idea what could be causing this? The systems are CentOS 6.4 with: bind-9.8.2-0.17.rc1.el6_4.4.x86_64 bind-dyndb-ldap-2.3-2.el6.x86_64 ipa-admintools-3.0.0-26.el6_4.2.x86_64 ipa-pki-ca-theme-9.0.3-7.el6.noarch libipa_hbac-1.9.2-82.7.el6_4.x86_64 libipa_hbac-python-1.9.2-82.7.el6_4.x86_64 ipa-pki-common-theme-9.0.3-7.el6.noarch python-iniparse-0.3.1-2.1.el6.noarch ipa-python-3.0.0-26.el6_4.2.x86_64 ipa-client-3.0.0-26.el6_4.2.x86_64 ipa-server-3.0.0-26.el6_4.2.x86_64 ipa-server-selinux-3.0.0-26.el6_4.2.x86_64 389-ds-base-libs-1.2.11.15-14.el6_4.x86_64 389-ds-base-1.2.11.15-14.el6_4.x86_64 Cheers, James -------------- next part -------------- An HTML attachment was scrubbed... URL: From pspacek at redhat.com Mon Jul 1 08:26:11 2013 From: pspacek at redhat.com (Petr Spacek) Date: Mon, 01 Jul 2013 10:26:11 +0200 Subject: [Freeipa-users] named seg faulting In-Reply-To: References: Message-ID: <51D13D23.3080404@redhat.com> On 1.7.2013 09:56, James Hogarth wrote: > Jun 30 03:10:01 ipa01 named[4228]: reloading configuration succeeded > Jun 30 03:10:01 ipa01 named[4228]: reloading zones succeeded > Jun 30 03:10:01 ipa01 named[4228]: task.c:1448: REQUIRE(task->state == > task_state_running) failed, back trace > Jun 30 03:10:01 ipa01 named[4228]: #0 0x7f1996e74eff in ?? > Jun 30 03:10:01 ipa01 named[4228]: #1 0x7f199582589a in ?? > Jun 30 03:10:01 ipa01 named[4228]: #2 0x7f1995843a8f in ?? > Jun 30 03:10:01 ipa01 named[4228]: #3 0x7f19904df97f in ?? > Jun 30 03:10:01 ipa01 named[4228]: #4 0x7f19904e0df3 in ?? > Jun 30 03:10:01 ipa01 named[4228]: #5 0x7f19904e3e8c in ?? > Jun 30 03:10:01 ipa01 named[4228]: #6 0x7f19951f9851 in ?? > Jun 30 03:10:01 ipa01 named[4228]: #7 0x7f199475b90d in ?? > Jun 30 03:10:01 ipa01 named[4228]: exiting (due to assertion failure) > > Has anyone else seen similar behaviour or have any idea what could be > causing this? > > The systems are CentOS 6.4 with: > bind-9.8.2-0.17.rc1.el6_4.4.x86_64 > bind-dyndb-ldap-2.3-2.el6.x86_64 You are using old version of bind-dyndb-ldap. Please see: http://rhn.redhat.com/errata/RHBA-2013-0739.html https://bugzilla.redhat.com/show_bug.cgi?id=928429 Upgrade to bind-dyndb-ldap-2.3-2.el6_4.1 should fix the problem. As usual, we recommend to use latest released bits. -- Petr^2 Spacek From james.hogarth at gmail.com Mon Jul 1 09:45:47 2013 From: james.hogarth at gmail.com (James Hogarth) Date: Mon, 1 Jul 2013 10:45:47 +0100 Subject: [Freeipa-users] named seg faulting In-Reply-To: <51D13D23.3080404@redhat.com> References: <51D13D23.3080404@redhat.com> Message-ID: > You are using old version of bind-dyndb-ldap. > > Please see: > http://rhn.redhat.com/errata/**RHBA-2013-0739.html > https://bugzilla.redhat.com/**show_bug.cgi?id=928429 > > Upgrade to bind-dyndb-ldap-2.3-2.el6_4.1 should fix the problem. > > Thanks Petr ... looks like that's not in the CentOS repositories ... I'll give those guys a heads up ... -------------- next part -------------- An HTML attachment was scrubbed... URL: From james.hogarth at gmail.com Mon Jul 1 10:06:22 2013 From: james.hogarth at gmail.com (James Hogarth) Date: Mon, 1 Jul 2013 11:06:22 +0100 Subject: [Freeipa-users] named seg faulting In-Reply-To: References: <51D13D23.3080404@redhat.com> Message-ID: > Upgrade to bind-dyndb-ldap-2.3-2.el6_4.1 should fix the problem. >> >> > Thanks Petr ... looks like that's not in the CentOS repositories ... I'll > give those guys a heads up ... > > > > A quick look and it appears that the SRPM isn't in the public FTP server ... opened bug https://bugzilla.redhat.com/show_bug.cgi?id=980046 to get this corrected. James -------------- next part -------------- An HTML attachment was scrubbed... URL: From pspacek at redhat.com Mon Jul 1 10:39:50 2013 From: pspacek at redhat.com (Petr Spacek) Date: Mon, 01 Jul 2013 12:39:50 +0200 Subject: [Freeipa-users] named seg faulting In-Reply-To: References: <51D13D23.3080404@redhat.com> Message-ID: <51D15C76.4060600@redhat.com> On 1.7.2013 12:06, James Hogarth wrote: >> Upgrade to bind-dyndb-ldap-2.3-2.el6_4.1 should fix the problem. >>> >>> >> Thanks Petr ... looks like that's not in the CentOS repositories ... I'll >> give those guys a heads up ... >> >> >> >> > > A quick look and it appears that the SRPM isn't in the public FTP server > ... opened bug https://bugzilla.redhat.com/show_bug.cgi?id=980046 to get > this corrected. I meanwhile I recommend you to build version 2.6: https://fedorahosted.org/released/bind-dyndb-ldap/bind-dyndb-ldap-2.6.tar.bz2 It includes some fixes not-yet accepted for RHEL. Build-requires list is pretty small: only bind-devel, krb5-devel and openldap-devel. The build itself is pretty straight-forward. -- Petr^2 Spacek From rcritten at redhat.com Mon Jul 1 18:16:18 2013 From: rcritten at redhat.com (Rob Crittenden) Date: Mon, 01 Jul 2013 14:16:18 -0400 Subject: [Freeipa-users] Service...not found in Kerberos database In-Reply-To: <51D1269A.30101@redhat.com> References: <1464774.RA4R9SJAkZ@hosanna> <51D1269A.30101@redhat.com> Message-ID: <51D1C772.4030703@redhat.com> Petr Spacek wrote: > On 29.6.2013 09:40, Joshua J. Kugler wrote: >> We are trying to query an IPA server from a new IPA server (not >> replication, >> just trying to query to recreate accounts). >> >> But, when I run the query, I get this: >> >> [root at ipan ~]# ipa -vvv -e >> xmlrpc_uri=https://ipa0.lab.whamcloud.com/ipa/xml >> user-show jkugler >> ipa: INFO: trying https://ipa0.lab.whamcloud.com/ipa/xml >> ipa: INFO: Forwarding 'user_show' to server >> u'https://ipa0.lab.whamcloud.com/ipa/xml' >> ipa: ERROR: Service 'HTTP at ipa0.lab.whamcloud.com' not found in Kerberos >> database >> >> I've done some googling, and what the answers I found had to do with DNS >> issues, but I don't believe that is the cause in our case, due to DNS >> lookups >> seeming to work. >> >> [root at ipan ~]# host ipan.lab.whamcloud.com >> ipan.lab.whamcloud.com has address 10.10.0.50 >> [root at ipan ~]# host ipa0.lab.whamcloud.com >> ipa0.lab.whamcloud.com has address 10.10.0.4 >> [root at ipan ~]# host 10.10.0.50 >> 50.0.10.10.in-addr.arpa domain name pointer ipan.lab.whamcloud.com. >> [root at ipan ~]# host 10.10.0.4 >> 4.0.10.10.in-addr.arpa domain name pointer ipa0.lab.whamcloud.com. >> >> What config do I need to tweak on the new server to allow it to query >> the old >> server? > > I guess that now you have two FreeIPA servers with different host names > but with the same FreeIPA domain and Kerberos REALM name, right? Please > correct me if I'm wrong. > > This configuration can't work with Kerberos authentication. > Authentication to only one server will work at one time, because there > is no reliable way how to find which KDC (old or new) you should query. > > IMHO the simplest way how to work around this situation is to generate > list of users etc. on the 'old' server, save the data to a file and > transfer files to the new server. (And then decommission the old server.) > > This will save you a pain caused by mis-configured Kerberos, but you > will have to solve file parsing. > You can also use ipa migrate-ds command to move users and groups from one IPA server to another. rob From rcritten at redhat.com Mon Jul 1 18:21:48 2013 From: rcritten at redhat.com (Rob Crittenden) Date: Mon, 01 Jul 2013 14:21:48 -0400 Subject: [Freeipa-users] migrate-ds "is not a POSIX user" In-Reply-To: <51CDFF35.8090604@redhat.com> References: <51CDE055.10801@redhat.com> <51CDFF35.8090604@redhat.com> Message-ID: <51D1C8BC.30005@redhat.com> Dmitri Pal wrote: > On 06/28/2013 03:13 PM, Dmitri Pal wrote: >> On 06/19/2013 04:39 PM, Alex Lawrence wrote: >>> Hello! >>> >>> I'm working on trying to migrate users into FreeIPA 3.1.5 (Fedora 18) >>> from DS389 (CentOS 6) 1.2.2. I've enabled migration on DS389 and I'm >>> attempting to migrate a subset of people using: >>> >>> ipa migrate-ds --user-container="ou=Systems & >>> Networking,ou=Personnel,dc=plu,dc=edu" --ignore* ldap://LDAP-SERVER:389 >>> >>> The out put is: >>> >>> ----------- >>> migrate-ds: >>> ----------- >>> Migrated: >>> Failed user: >>> %UID%: %UID% is not a POSIX user >>> %UID%: %UID% is not a POSIX user >>> %UID%: %UID% is not a POSIX user >>> >>> And so on. >>> >>> I've imported my schema into FreeIPA so that it knows my additional >>> attributes; however, just to be safe I've also tried running the >>> import ignoring any objectclass in use with the same output. >>> >>> --user-ignore-objectclass=pluEduPerson,mailRecipient,eduPerson,posixAccount,inetOrgPerson,organizationalPerson >>> >>> I've added the posixAccount object class to a handful of accounts in >>> question on my DS389 side to be sure that was not an issue either and >>> that gives me the same result. >>> >>> I'm sure this is something simple that I'm missing, any suggestions >>> would be appreciated. > > > Please check the accounts that are skipped, they are most likely missing > some POSIX required attribute (though from LDAP point of view it is an > optional attribute), UID for example or SN. > Please add missing attributes and try again. The easiest way to do this > is to compare posix attributes between the entry that is migrated > without problems and one that is not accepted. There are only 6 posix > attributes so it should be easy to spot. > > If you can't do it in your existing instance take an LDIF load it it > into another instance and modify users there then migrate from that > instance. > I hope this would give you at least a starting point, have a nice weekend. We look for gidNumber when doing the migration. Users without one aren't migrated. rob From joshua at azariah.com Tue Jul 2 06:28:58 2013 From: joshua at azariah.com (Joshua J. Kugler) Date: Mon, 01 Jul 2013 22:28:58 -0800 Subject: [Freeipa-users] Service...not found in Kerberos database In-Reply-To: <51D1C772.4030703@redhat.com> References: <1464774.RA4R9SJAkZ@hosanna> <51D1269A.30101@redhat.com> <51D1C772.4030703@redhat.com> Message-ID: <2718450.WmELabvR7a@hosanna> On Monday, July 01, 2013 14:16:18 Rob Crittenden wrote: > You can also use ipa migrate-ds command to move users and groups from > one IPA server to another. That might be an option, but I take it, due to the Kerberos stuff, that it will not migrate passwords? Getting full replication working would be required for that, no? j -- Joshua J. Kugler - Fairbanks, Alaska Azariah Enterprises - Programming and Website Design joshua at azariah.com - Jabber: pedahzur at gmail.com PGP Key: http://pgp.mit.edu/ ID 0x73B13B6A From james.hogarth at gmail.com Tue Jul 2 06:34:26 2013 From: james.hogarth at gmail.com (James Hogarth) Date: Tue, 2 Jul 2013 07:34:26 +0100 Subject: [Freeipa-users] named seg faulting In-Reply-To: <51D15C76.4060600@redhat.com> References: <51D13D23.3080404@redhat.com> <51D15C76.4060600@redhat.com> Message-ID: > > I meanwhile I recommend you to build version 2.6: > https://fedorahosted.org/released/bind-dyndb-ldap/bind-dyndb-ldap-2.6.tar.bz2 > > It includes some fixes not-yet accepted for RHEL. > Interesting... I might build and test but generally I prefer to keep to packages accepted to rhel... As an FYI to other CentOS users the srpm was published yesterday and was built and pushed to the CentOS repositories last night. -------------- next part -------------- An HTML attachment was scrubbed... URL: From linux at karasik.org Tue Jul 2 12:41:54 2013 From: linux at karasik.org (Vitaly) Date: Tue, 2 Jul 2013 15:41:54 +0300 Subject: [Freeipa-users] How to change krbPasswordExpiration for service accounts Message-ID: I already read https://www.redhat.com/archives/freeipa-users/2012-September/msg00026.htmlthread, but I am not sure I understand suggested solution. So my question - how I can change krbPasswordExpiration for certain account? ipa user-mod service --setattr=krbPasswordExpiration=20381231011529Z returns ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the 'krbPasswordExpiration' attribute of entry 'uid=service,cn=users,cn=accounts,dc=example,dc=com'. TIA, Vitaly -------------- next part -------------- An HTML attachment was scrubbed... URL: From linux at karasik.org Tue Jul 2 13:00:15 2013 From: linux at karasik.org (Vitaly) Date: Tue, 2 Jul 2013 16:00:15 +0300 Subject: [Freeipa-users] How to change krbPasswordExpiration for service accounts Message-ID: >I already read https://www.redhat.com/archives/freeipa-users/2012-September/msg00026.html >thread, but I am not sure I understand suggested solution. >So my question - how I can change krbPasswordExpiration for certain account? >ipa user-mod service --setattr=krbPasswordExpiration=20381231011529Z >returns >ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the 'krbPasswordExpiration' attribute >of entry 'uid=service,cn=users,cn=accounts,dc=example,dc=com'. Sorry, my bad, please ignore - ldapmodify workaround works, From sbose at redhat.com Tue Jul 2 13:07:33 2013 From: sbose at redhat.com (Sumit Bose) Date: Tue, 2 Jul 2013 15:07:33 +0200 Subject: [Freeipa-users] How to change krbPasswordExpiration for service accounts In-Reply-To: References: Message-ID: <20130702130733.GM27655@localhost.localdomain> On Tue, Jul 02, 2013 at 03:41:54PM +0300, Vitaly wrote: > I already read > https://www.redhat.com/archives/freeipa-users/2012-September/msg00026.htmlthread, > but I am not sure I understand suggested solution. > So my question - how I can change krbPasswordExpiration for certain account? > > ipa user-mod service --setattr=krbPasswordExpiration=20381231011529Z if you want that the password never expires for some users you should created a password policy where the password never expires and assign the policy to the users. See 'ipa help pwpolicy' for more details. HTH bye, Sumit > > returns > > ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the > 'krbPasswordExpiration' attribute of entry > 'uid=service,cn=users,cn=accounts,dc=example,dc=com'. > > TIA, > Vitaly > _______________________________________________ > Freeipa-users mailing list > Freeipa-users at redhat.com > https://www.redhat.com/mailman/listinfo/freeipa-users From linux at karasik.org Tue Jul 2 13:21:37 2013 From: linux at karasik.org (Vitaly) Date: Tue, 2 Jul 2013 16:21:37 +0300 Subject: [Freeipa-users] How to change krbPasswordExpiration for service accounts In-Reply-To: <20130702130733.GM27655@localhost.localdomain> References: <20130702130733.GM27655@localhost.localdomain> Message-ID: >if you want that the password never expires for some users you should >created a password policy where the password never expires and assign >the policy to the users. Thank you, Sumit. As far as I understand, I need to tweak krbPasswordExpiration anyway if password was changed before password policy was applied. >From another side, I have a weird issue with password policy: #ipa user-show serviceinvoker --all .... Member of groups: ...., services #ipa pwpolicy-show services Group: services But # ipa pwpolicy-show --user serviceinvoker Group: global_policy On Tue, Jul 2, 2013 at 4:07 PM, Sumit Bose wrote: > On Tue, Jul 02, 2013 at 03:41:54PM +0300, Vitaly wrote: >> I already read >> https://www.redhat.com/archives/freeipa-users/2012-September/msg00026.htmlthread, >> but I am not sure I understand suggested solution. >> So my question - how I can change krbPasswordExpiration for certain account? >> >> ipa user-mod service --setattr=krbPasswordExpiration=20381231011529Z > > if you want that the password never expires for some users you should > created a password policy where the password never expires and assign > the policy to the users. > > See 'ipa help pwpolicy' for more details. > > HTH > > bye, > Sumit >> >> returns >> >> ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the >> 'krbPasswordExpiration' attribute of entry >> 'uid=service,cn=users,cn=accounts,dc=example,dc=com'. >> >> TIA, >> Vitaly > >> _______________________________________________ >> Freeipa-users mailing list >> Freeipa-users at redhat.com >> https://www.redhat.com/mailman/listinfo/freeipa-users > > _______________________________________________ > Freeipa-users mailing list > Freeipa-users at redhat.com > https://www.redhat.com/mailman/listinfo/freeipa-users From rcritten at redhat.com Tue Jul 2 13:32:30 2013 From: rcritten at redhat.com (Rob Crittenden) Date: Tue, 02 Jul 2013 09:32:30 -0400 Subject: [Freeipa-users] How to change krbPasswordExpiration for service accounts In-Reply-To: References: <20130702130733.GM27655@localhost.localdomain> Message-ID: <51D2D66E.5040009@redhat.com> Vitaly wrote: >> if you want that the password never expires for some users you should >> created a password policy where the password never expires and assign >> the policy to the users. > Thank you, Sumit. > As far as I understand, I need to tweak krbPasswordExpiration anyway > if password was changed before password policy was applied. > >>From another side, I have a weird issue with password policy: > > #ipa user-show serviceinvoker --all > .... > Member of groups: ...., services > > #ipa pwpolicy-show services > Group: services > > But > # ipa pwpolicy-show --user serviceinvoker > Group: global_policy Curious. We'd need to see more details of the password policy, priority for example. Does this show the right policy? ipa user-show --all serviceinvoker |grep krbpwdpolicyreference > > On Tue, Jul 2, 2013 at 4:07 PM, Sumit Bose wrote: >> On Tue, Jul 02, 2013 at 03:41:54PM +0300, Vitaly wrote: >>> I already read >>> https://www.redhat.com/archives/freeipa-users/2012-September/msg00026.htmlthread, >>> but I am not sure I understand suggested solution. >>> So my question - how I can change krbPasswordExpiration for certain account? >>> >>> ipa user-mod service --setattr=krbPasswordExpiration=20381231011529Z >> >> if you want that the password never expires for some users you should >> created a password policy where the password never expires and assign >> the policy to the users. >> >> See 'ipa help pwpolicy' for more details. >> >> HTH >> >> bye, >> Sumit >>> >>> returns >>> >>> ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the >>> 'krbPasswordExpiration' attribute of entry >>> 'uid=service,cn=users,cn=accounts,dc=example,dc=com'. >>> >>> TIA, >>> Vitaly >> >>> _______________________________________________ >>> Freeipa-users mailing list >>> Freeipa-users at redhat.com >>> https://www.redhat.com/mailman/listinfo/freeipa-users >> >> _______________________________________________ >> Freeipa-users mailing list >> Freeipa-users at redhat.com >> https://www.redhat.com/mailman/listinfo/freeipa-users > > _______________________________________________ > Freeipa-users mailing list > Freeipa-users at redhat.com > https://www.redhat.com/mailman/listinfo/freeipa-users > From linux at karasik.org Tue Jul 2 13:43:46 2013 From: linux at karasik.org (Vitaly) Date: Tue, 2 Jul 2013 16:43:46 +0300 Subject: [Freeipa-users] How to change krbPasswordExpiration for service accounts In-Reply-To: <51D2D66E.5040009@redhat.com> References: <20130702130733.GM27655@localhost.localdomain> <51D2D66E.5040009@redhat.com> Message-ID: # ipa user-show --all serviceinvoker |grep krbpwdpolicyreference krbpwdpolicyreference: cn=global_policy,cn=EXAMPLE.COM,cn=kerberos,dc=example,dc=com On Tue, Jul 2, 2013 at 4:32 PM, Rob Crittenden wrote: > Vitaly wrote: >>> >>> if you want that the password never expires for some users you should >>> created a password policy where the password never expires and assign >>> the policy to the users. >> >> Thank you, Sumit. >> As far as I understand, I need to tweak krbPasswordExpiration anyway >> if password was changed before password policy was applied. >> >>> From another side, I have a weird issue with password policy: >> >> >> #ipa user-show serviceinvoker --all >> .... >> Member of groups: ...., services >> >> #ipa pwpolicy-show services >> Group: services >> >> But >> # ipa pwpolicy-show --user serviceinvoker >> Group: global_policy > > > Curious. We'd need to see more details of the password policy, priority for > example. > > Does this show the right policy? > > ipa user-show --all serviceinvoker |grep krbpwdpolicyreference > > >> >> On Tue, Jul 2, 2013 at 4:07 PM, Sumit Bose wrote: >>> >>> On Tue, Jul 02, 2013 at 03:41:54PM +0300, Vitaly wrote: >>>> >>>> I already read >>>> >>>> https://www.redhat.com/archives/freeipa-users/2012-September/msg00026.htmlthread, >>>> but I am not sure I understand suggested solution. >>>> So my question - how I can change krbPasswordExpiration for certain >>>> account? >>>> >>>> ipa user-mod service --setattr=krbPasswordExpiration=20381231011529Z >>> >>> >>> if you want that the password never expires for some users you should >>> created a password policy where the password never expires and assign >>> the policy to the users. >>> >>> See 'ipa help pwpolicy' for more details. >>> >>> HTH >>> >>> bye, >>> Sumit >>>> >>>> >>>> returns >>>> >>>> ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the >>>> 'krbPasswordExpiration' attribute of entry >>>> 'uid=service,cn=users,cn=accounts,dc=example,dc=com'. >>>> >>>> TIA, >>>> Vitaly >>> >>> >>>> _______________________________________________ >>>> Freeipa-users mailing list >>>> Freeipa-users at redhat.com >>>> https://www.redhat.com/mailman/listinfo/freeipa-users >>> >>> >>> _______________________________________________ >>> Freeipa-users mailing list >>> Freeipa-users at redhat.com >>> https://www.redhat.com/mailman/listinfo/freeipa-users >> >> >> _______________________________________________ >> Freeipa-users mailing list >> Freeipa-users at redhat.com >> https://www.redhat.com/mailman/listinfo/freeipa-users >> > From rcritten at redhat.com Tue Jul 2 14:49:16 2013 From: rcritten at redhat.com (Rob Crittenden) Date: Tue, 02 Jul 2013 10:49:16 -0400 Subject: [Freeipa-users] Service...not found in Kerberos database In-Reply-To: <2718450.WmELabvR7a@hosanna> References: <1464774.RA4R9SJAkZ@hosanna> <51D1269A.30101@redhat.com> <51D1C772.4030703@redhat.com> <2718450.WmELabvR7a@hosanna> Message-ID: <51D2E86C.2050009@redhat.com> Joshua J. Kugler wrote: > On Monday, July 01, 2013 14:16:18 Rob Crittenden wrote: >> You can also use ipa migrate-ds command to move users and groups from >> one IPA server to another. > > That might be an option, but I take it, due to the Kerberos stuff, that it will > not migrate passwords? Getting full replication working would be required for > that, no? Passwords are migrated but users will need to go through a password migration process to create Kerberos credentials. This is all seemless with sssd. rob From arthur at deus.pro Tue Jul 2 18:35:36 2013 From: arthur at deus.pro (Arthur) Date: Wed, 03 Jul 2013 00:35:36 +0600 Subject: [Freeipa-users] FreeIPA as Samba 4 Backend In-Reply-To: <1372424252.31944.10.camel@willson.li.ssimo.org> References: <1372424252.31944.10.camel@willson.li.ssimo.org> Message-ID: <51D31D78.1090507@deus.pro> 28.06.2013 18:57, Simo Sorce ?????: > On Fri, 2013-06-28 at 14:09 +0800, Mail Robot wrote: >> Hi everyone, >> >> >> I am new to this mailing list. >> >> >> At the moment I would like to migrate all of my users from Microsoft >> Active Directory to Open Source, and what I have in mind is getting it >> into Samba 4. >> >> >> In extending the functionality of it, I decided to intergrate FreeIPA >> as the backend to Samba 4. >> >> >> I saw some obsolete reference on how to use FreeIPA as Samba 4 >> backend, but I don't know where are the new reference. >> >> >> Herewith I would seek advise on how to go for my mission. > Sorry to foil your plans but FreIPa cannot be used as an LDAP backend to > Samba4. > We abandoned that path a few years ago as it became clear it was highly > unlikely it would work. > > What we've done is that we change our integratioj strategy and > introduced cross-realm trusts that would with Active Directory. In the > future this should work also with Samba4, but Samba4 code base currently > lacks support for cross-forest trusts. > > Simo. > Does it mean, that I can not make cross-realm trust between IPA-server & Samba4-server at this time? From arthur at deus.pro Tue Jul 2 18:40:31 2013 From: arthur at deus.pro (Arthur) Date: Wed, 03 Jul 2013 00:40:31 +0600 Subject: [Freeipa-users] question about bind 10 plans In-Reply-To: <1367226587.2436.15.camel@arthur.bashnl.ru> References: <1367208810.2436.10.camel@arthur.bashnl.ru> <20130429051135.GG7607@redhat.com> <1367217618.2436.12.camel@arthur.bashnl.ru> <517E25C1.4020507@redhat.com> <1367226587.2436.15.camel@arthur.bashnl.ru> Message-ID: <51D31E9F.80501@deus.pro> 29.04.2013 15:09, ????? ????????? ?????: > ? ??., 29/04/2013 ? 09:48 +0200, Petr Spacek ?????: >> On 29.4.2013 08:40, ????? ????????? wrote: >>> ? ??., 29/04/2013 ? 08:11 +0300, Alexander Bokovoy ?????: >>>> Bind 10 module is on our radar. >> There is not much to add. I'm in touch with one Bind 10 developer and we are >> discussing various possibilities of integration. >> >> Let me know if you are interested in aplha/beta testing. I will send you an >> e-mail as soon as we have some testable code. >> > Yes, I am interested in that :) > Now I have some resources to do that, I do not know about future, but > know I do :) > > _______________________________________________ > Freeipa-users mailing list > Freeipa-users at redhat.com > https://www.redhat.com/mailman/listinfo/freeipa-users I am even interested in just bind10 ldap-backend, not allready IPA-server with bind10. From pspacek at redhat.com Wed Jul 3 06:47:40 2013 From: pspacek at redhat.com (Petr Spacek) Date: Wed, 03 Jul 2013 08:47:40 +0200 Subject: [Freeipa-users] FreeIPA as Samba 4 Backend In-Reply-To: <51D31D78.1090507@deus.pro> References: <1372424252.31944.10.camel@willson.li.ssimo.org> <51D31D78.1090507@deus.pro> Message-ID: <51D3C90C.8040908@redhat.com> On 2.7.2013 20:35, Arthur wrote: > 28.06.2013 18:57, Simo Sorce ?????: >> On Fri, 2013-06-28 at 14:09 +0800, Mail Robot wrote: >>> Hi everyone, >>> >>> >>> I am new to this mailing list. >>> >>> >>> At the moment I would like to migrate all of my users from Microsoft >>> Active Directory to Open Source, and what I have in mind is getting it >>> into Samba 4. >>> >>> >>> In extending the functionality of it, I decided to intergrate FreeIPA >>> as the backend to Samba 4. >>> >>> >>> I saw some obsolete reference on how to use FreeIPA as Samba 4 >>> backend, but I don't know where are the new reference. >>> >>> >>> Herewith I would seek advise on how to go for my mission. >> Sorry to foil your plans but FreIPa cannot be used as an LDAP backend to >> Samba4. >> We abandoned that path a few years ago as it became clear it was highly >> unlikely it would work. >> >> What we've done is that we change our integratioj strategy and >> introduced cross-realm trusts that would with Active Directory. In the >> future this should work also with Samba4, but Samba4 code base currently >> lacks support for cross-forest trusts. >> >> Simo. >> > Does it mean, that I can not make cross-realm trust between IPA-server & > Samba4-server at this time? Yes, it is Samba 4 limitation. -- Petr^2 Spacek From pspacek at redhat.com Wed Jul 3 06:50:18 2013 From: pspacek at redhat.com (Petr Spacek) Date: Wed, 03 Jul 2013 08:50:18 +0200 Subject: [Freeipa-users] question about bind 10 plans In-Reply-To: <51D31E9F.80501@deus.pro> References: <1367208810.2436.10.camel@arthur.bashnl.ru> <20130429051135.GG7607@redhat.com> <1367217618.2436.12.camel@arthur.bashnl.ru> <517E25C1.4020507@redhat.com> <1367226587.2436.15.camel@arthur.bashnl.ru> <51D31E9F.80501@deus.pro> Message-ID: <51D3C9AA.5030703@redhat.com> On 2.7.2013 20:40, Arthur wrote: > 29.04.2013 15:09, ????? ????????? ?????: >> ? ??., 29/04/2013 ? 09:48 +0200, Petr Spacek ?????: >>> On 29.4.2013 08:40, ????? ????????? wrote: >>>> ? ??., 29/04/2013 ? 08:11 +0300, Alexander Bokovoy ?????: >>>>> Bind 10 module is on our radar. >>> There is not much to add. I'm in touch with one Bind 10 developer and we are >>> discussing various possibilities of integration. >>> >>> Let me know if you are interested in aplha/beta testing. I will send you an >>> e-mail as soon as we have some testable code. >>> >> Yes, I am interested in that :) >> Now I have some resources to do that, I do not know about future, but >> know I do :) Please stay tuned. At the moment we have hands full with DNSSEC support, but one student from Brno University of Technology took this topic as his diploma thesis. Hopefully we will see some prototype in near future. -- Petr^2 Spacek From fvzwieten at vxcompany.com Wed Jul 3 07:33:16 2013 From: fvzwieten at vxcompany.com (Fred van Zwieten) Date: Wed, 3 Jul 2013 09:33:16 +0200 Subject: [Freeipa-users] IPA, Samba and AD Message-ID: Hi there, We have an IPA domain and an AD domain with the exact same domain name. This was set up like this because we had the idea at the time that we wanted to migrate all AD to IPA. This is still the long term goal, but we need to postpone that. All our RHEL62 and RHEL64 servers are IPA clients. Now, we want to provision a new RHEL64 server who must run a Samba Server which must be member of the AD domain. Questions: 1. If this possible? 2. Will the fact that both IPA and AD have the same name be a problem? I did some preliminary looking around and found the file /etc/krb5.conf as a possible problem point. Thanks for thinking along! Fred Seeing, contrary to popular wisdom, isn?t believing. It?s where belief stops, because it isn?t needed any more.. (Terry Pratchett) -------------- next part -------------- An HTML attachment was scrubbed... URL: From abokovoy at redhat.com Wed Jul 3 10:01:03 2013 From: abokovoy at redhat.com (Alexander Bokovoy) Date: Wed, 3 Jul 2013 13:01:03 +0300 Subject: [Freeipa-users] IPA, Samba and AD In-Reply-To: References: Message-ID: <20130703100103.GB12345@leiri.espoo.7ia.org> On Wed, 03 Jul 2013, Fred van Zwieten wrote: >Hi there, > >We have an IPA domain and an AD domain with the exact same domain name. >This was set up like this because we had the idea at the time that we >wanted to migrate all AD to IPA. This is still the long term goal, but we >need to postpone that. > >All our RHEL62 and RHEL64 servers are IPA clients. Now, we want to >provision a new RHEL64 server who must run a Samba Server which must be >member of the AD domain. > >Questions: > >1. If this possible? >2. Will the fact that both IPA and AD have the same name be a problem? > >I did some preliminary looking around and found the file /etc/krb5.conf as >a possible problem point. It would help to explain a bit more about your setup. 1. Do you have the same realms for both IPA and AD? 2. Do you have exactly same DNS domains for both IPA and AD? If I get correctly from the above description, your new RHEL 6.4 server is enrolled into IPA domain, i.e. its host keytab contains keys to the host service coming from IPA KDC. It probably also uses SSSD in both nsswitch and PAM configurations? Are you planning to use pam_winbind/nss_winbind for the Samba/AD interoperability? You can avoid hitting conflicting /etc/krb5.conf for both IPA and AD uses by containing Samba to use separate krb5.conf. You'll need to add KRB5_CONFIG=/path/to/specific/krb5.conf to the files that are sources during start up of smbd/winbindd/nmbd. However, there will be certain problem with pam_winbind since it does not allow to redefine krb5.conf. -- / Alexander Bokovoy From abokovoy at redhat.com Wed Jul 3 10:01:56 2013 From: abokovoy at redhat.com (Alexander Bokovoy) Date: Wed, 3 Jul 2013 13:01:56 +0300 Subject: [Freeipa-users] FreeIPA as Samba 4 Backend In-Reply-To: <51D31D78.1090507@deus.pro> References: <1372424252.31944.10.camel@willson.li.ssimo.org> <51D31D78.1090507@deus.pro> Message-ID: <20130703100156.GC12345@leiri.espoo.7ia.org> On Wed, 03 Jul 2013, Arthur wrote: >28.06.2013 18:57, Simo Sorce ?????: >>On Fri, 2013-06-28 at 14:09 +0800, Mail Robot wrote: >>>Hi everyone, >>> >>> >>>I am new to this mailing list. >>> >>> >>>At the moment I would like to migrate all of my users from Microsoft >>>Active Directory to Open Source, and what I have in mind is getting it >>>into Samba 4. >>> >>> >>>In extending the functionality of it, I decided to intergrate FreeIPA >>>as the backend to Samba 4. >>> >>> >>>I saw some obsolete reference on how to use FreeIPA as Samba 4 >>>backend, but I don't know where are the new reference. >>> >>> >>>Herewith I would seek advise on how to go for my mission. >>Sorry to foil your plans but FreIPa cannot be used as an LDAP backend to >>Samba4. >>We abandoned that path a few years ago as it became clear it was highly >>unlikely it would work. >> >>What we've done is that we change our integratioj strategy and >>introduced cross-realm trusts that would with Active Directory. In the >>future this should work also with Samba4, but Samba4 code base currently >>lacks support for cross-forest trusts. >> >>Simo. >> >Does it mean, that I can not make cross-realm trust between >IPA-server & Samba4-server at this time? No, you cannot achieve cross-realm trust with Samba AD DC right now. -- / Alexander Bokovoy From fvzwieten at vxcompany.com Wed Jul 3 12:01:40 2013 From: fvzwieten at vxcompany.com (Fred van Zwieten) Date: Wed, 3 Jul 2013 14:01:40 +0200 Subject: [Freeipa-users] IPA, Samba and AD In-Reply-To: <20130703091127.GN24422@vda.li> References: <20130703091127.GN24422@vda.li> Message-ID: 1. Do you have the same realms for both IPA and AD? Yes. 2. Do you have exactly same DNS domains for both IPA and AD? Also yes. Because of this we must, for now, maintain 2 seperate DNS implementations: one for AD and one for IPA, because otherwise the service records would name-clash. If I get correctly from the above description, your new RHEL 6.4 server is enrolled into IPA domain, i.e. its host keytab contains keys to the host service coming from IPA KDC. It probably also uses SSSD in both nsswitch and PAM configurations? Correct! Are you planning to use pam_winbind/nss_winbind for the Samba/AD interoperability? I don't know yet. It depends on what works best with this setup. I am not (yet) a Samba wunderguy, so these discussions help me (thanks for that). Fred On Wed, Jul 3, 2013 at 11:11 AM, Alexander Bokovoy wrote: > On Wed, 03 Jul 2013, Fred van Zwieten wrote: > >Hi there, > > > >We have an IPA domain and an AD domain with the exact same domain name. > >This was set up like this because we had the idea at the time that we > >wanted to migrate all AD to IPA. This is still the long term goal, but we > >need to postpone that. > > > >All our RHEL62 and RHEL64 servers are IPA clients. Now, we want to > >provision a new RHEL64 server who must run a Samba Server which must be > >member of the AD domain. > > > >Questions: > > > >1. If this possible? > >2. Will the fact that both IPA and AD have the same name be a problem? > > > >I did some preliminary looking around and found the file /etc/krb5.conf as > >a possible problem point. > It would help to explain a bit more about your setup. > > 1. Do you have the same realms for both IPA and AD? > 2. Do you have exactly same DNS domains for both IPA and AD? > > If I get correctly from the above description, your new RHEL 6.4 server > is enrolled into IPA domain, i.e. its host keytab contains keys to > the host service coming from IPA KDC. It probably also uses SSSD in both > nsswitch and PAM configurations? Are you planning to use > pam_winbind/nss_winbind for the Samba/AD interoperability? > > You can avoid hitting conflicting /etc/krb5.conf for both IPA and AD > uses by containing Samba to use separate krb5.conf. You'll need to add > > KRB5_CONFIG=/path/to/specific/krb5.conf > > to the files that are sources during start up of smbd/winbindd/nmbd. > > However, there will be certain problem with pam_winbind since it does > not allow to redefine krb5.conf. > > -- > / Alexander Bokovoy > -------------- next part -------------- An HTML attachment was scrubbed... URL: From mmercier at gmail.com Wed Jul 3 14:17:19 2013 From: mmercier at gmail.com (Michael Mercier) Date: Wed, 3 Jul 2013 10:17:19 -0400 Subject: [Freeipa-users] Login hangs / hung task? Message-ID: Hello, I tried to login (ssh) to one (of three) freeipa systems running on CentOS yesterday without success. Running 'ssh root at service-2', the server would reply with a password prompt and then hang. I went to the system console to discover many of the following messages on screen: Jun 30