Forgot to CC the mailing list on my original reply. <br><br><div class="gmail_quote">On Tue, Feb 9, 2010 at 2:40 PM, Scott Kaminski <span dir="ltr"><<a href="mailto:scott.kaminski@gmail.com">scott.kaminski@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><br><br><div class="gmail_quote"><div class="im">On Tue, Feb 9, 2010 at 11:34 AM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>Scott Kaminski wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
I have a cactiEZ v0.6 server, and its actually running CentOS4.7. I wanted to hook my cacti to my FreeIPA domain. I seam to have a number of issues I can't actually work out with this machine and they appear to be related to HTTP kerberos authentication.<br>
<br>
I seam to be-able to authenticate to the machine locally using FreeIPA without any major issues. I noticed one thing that seams odd to me is that when I execute id as a user on C5 machine i see all my group membership, when I login to the C4 machine and execute id I only see 1 group associate for my user account and other user accounts have the same issue.<br>
<br>
I want to access the machine by host and ip. I can authenticate via hostname without a problem. When i attempt to access the machine via ip it doesn't work. I have a C5 machine that doesn't have this problem, hostname or ip i can authenticate.<br>
<br>
When I attempt to access via the ip here is what shows in the apache logs:<br>
<br>
[Mon Feb 08 17:23:04 2010] [error] [client 192.168.169.194] krb5_sname_to_principal() failed: Cannot determine realm for numeric host address<br>
</blockquote>
<br></div>
Does the IP resolve into a host name? I think that may be the problem.<div><br></div></blockquote></div><div><br>Keep in mind this is authentication via apache that is giving me problems at this point. If I login to the server via ssh I can do passwordless authentication from this machine to other servers and from other servers to this machine, assuming i have a valid krb ticket. <br>
<br>Here is verification of the dns entries just incase: <br>[root@ldap-6 log]# dig +short -x 172.16.2.36<br>wtw-man6.quadrant.local.<br>[root@ldap-6 log]# dig +short wtw-man6.quadrant.local<br>172.16.2.36<br><br>The clientip listed above is not part of the IPA domain if that really matters. To clairfy if i put in my browser https://wtw-man6.quadrant.local/scott i can successfully authenticate. If i do <a href="https://172.16.2.36/scott" target="_blank">https://172.16.2.36/scott</a> I cannot authenticate and i see the above log message in the apache error log. <br>
<br>I just tried it now and here is what showed up in the krb5.log <br><br>Feb 09 14:34:07 ldap-5.quadrant.local krb5kdc[2628](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://172.16.2.36" target="_blank">172.16.2.36</a>: NEEDED_PREAUTH: scottk@QUADRANT.LOCAL for krbtgt/QUADRANT.LOCAL@QUADRANT.LOCAL, Additional pre-authentication required<br>
Feb 09 14:34:07 ldap-5.quadrant.local krb5kdc[2628](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://172.16.2.36" target="_blank">172.16.2.36</a>: ISSUE: authtime 1265754847, etypes {rep=18 tkt=18 ses=18}, scottk@QUADRANT.LOCAL for krbtgt/QUADRANT.LOCAL@QUADRANT.LOCAL<br>
<br><br>If i use wtw-man6.quadrant.local i see this instead in the krb log which looks like a valid request/ticket issue process.<br><br>Feb 09 14:34:54 ldap-5.quadrant.local krb5kdc[2628](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://172.16.2.36" target="_blank">172.16.2.36</a>: ISSUE: authtime 1265754894, etypes {rep=18 tkt=18 ses=18}, scottk@QUADRANT.LOCAL for krbtgt/QUADRANT.LOCAL@QUADRANT.LOCAL<br>
Feb 09 14:34:54 ldap-5.quadrant.local krb5kdc[2628](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://172.16.2.36" target="_blank">172.16.2.36</a>: ISSUE: authtime 1265754894, etypes {rep=18 tkt=18 ses=18}, scottk@QUADRANT.LOCAL for HTTP/wtw-man6.quadrant.local@QUADRANT.LOCAL<br>
Feb 09 14:34:54 ldap-5.quadrant.local krb5kdc[2628](info): DISPATCH: repeated (retransmitted?) request from 172.16.2.36, resending previous response<br>Feb 09 14:34:54 ldap-5.quadrant.local krb5kdc[2628](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://172.16.2.36" target="_blank">172.16.2.36</a>: ISSUE: authtime 1265754894, etypes {rep=18 tkt=18 ses=18}, scottk@QUADRANT.LOCAL for krbtgt/QUADRANT.LOCAL@QUADRANT.LOCAL<br>
Feb 09 14:34:54 ldap-5.quadrant.local krb5kdc[2628](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://172.16.2.36" target="_blank">172.16.2.36</a>: ISSUE: authtime 1265754894, etypes {rep=18 tkt=18 ses=18}, scottk@QUADRANT.LOCAL for HTTP/wtw-man6.quadrant.local@QUADRANT.LOCAL<br>
Feb 09 14:34:55 ldap-5.quadrant.local krb5kdc[2628](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://172.16.2.36" target="_blank">172.16.2.36</a>: NEEDED_PREAUTH: scottk@QUADRANT.LOCAL for krbtgt/QUADRANT.LOCAL@QUADRANT.LOCAL, Additional pre-authentication required<br>
Feb 09 14:34:55 ldap-5.quadrant.local krb5kdc[2628](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://172.16.2.36" target="_blank">172.16.2.36</a>: ISSUE: authtime 1265754895, etypes {rep=18 tkt=18 ses=18}, scottk@QUADRANT.LOCAL for krbtgt/QUADRANT.LOCAL@QUADRANT.LOCAL<br>
Feb 09 14:34:55 ldap-5.quadrant.local krb5kdc[2628](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://172.16.2.36" target="_blank">172.16.2.36</a>: ISSUE: authtime 1265754895, etypes {rep=18 tkt=18 ses=18}, scottk@QUADRANT.LOCAL for HTTP/wtw-man6.quadrant.local@QUADRANT.LOCAL<br>
Feb 09 14:34:55 ldap-5.quadrant.local krb5kdc[2628](info): DISPATCH: repeated (retransmitted?) request from 172.16.2.36, resending previous response<br>Feb 09 14:34:55 ldap-5.quadrant.local krb5kdc[2628](info): DISPATCH: repeated (retransmitted?) request from 172.16.2.36, resending previous response<br>
Feb 09 14:34:55 ldap-5.quadrant.local krb5kdc[2628](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://172.16.2.36" target="_blank">172.16.2.36</a>: ISSUE: authtime 1265754895, etypes {rep=18 tkt=18 ses=18}, scottk@QUADRANT.LOCAL for krbtgt/QUADRANT.LOCAL@QUADRANT.LOCAL<br>
Feb 09 14:34:55 ldap-5.quadrant.local krb5kdc[2628](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://172.16.2.36" target="_blank">172.16.2.36</a>: ISSUE: authtime 1265754895, etypes {rep=18 tkt=18 ses=18}, scottk@QUADRANT.LOCAL for HTTP/wtw-man6.quadrant.local@QUADRANT.LOCAL<br>
Feb 09 14:34:55 ldap-5.quadrant.local krb5kdc[2628](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://172.16.2.36" target="_blank">172.16.2.36</a>: ISSUE: authtime 1265754895, etypes {rep=18 tkt=18 ses=18}, scottk@QUADRANT.LOCAL for krbtgt/QUADRANT.LOCAL@QUADRANT.LOCAL<br>
Feb 09 14:34:55 ldap-5.quadrant.local krb5kdc[2628](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://172.16.2.36" target="_blank">172.16.2.36</a>: ISSUE: authtime 1265754895, etypes {rep=18 tkt=18 ses=18}, scottk@QUADRANT.LOCAL for HTTP/wtw-man6.quadrant.local@QUADRANT.LOCAL<br>
<br><br></div><div><div></div><div class="h5"><div> </div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Here are the packages i installed:<br>
[root@wtw-man6 conf]# rpm -qa | grep mod_auth<br>
mod_auth_kerb-5.0-1.3<br>
mod_authz_ldap-0.26-2.1<br>
<br>
Here is my apache auth configuration:<br>
<Location /scott><br>
SSLRequireSSL<br>
AuthType Kerberos<br>
AuthName "Cacti login"<br>
<br>
KrbMethodNegotiate on<br>
KrbMethodK5Passwd on<br>
KrbServiceName HTTP<br>
<br>
KrbAuthRealms QUADRANT.LOCAL<br>
Krb5KeyTab /etc/httpd/conf/http.keytab<br>
KrbSaveCredentials on<br>
#KrbVerifyKDC off<br>
AuthLDAPUrl ldap://ldap.quadrant.local:389/dc=quadrant,dc=local?krbPrincipalName<br>
#require group cn=NetopsResources,cn=groups,cn=accounts,dc=quadrant,dc=local<br>
require valid-user<br>
</Location><br>
<br>
C4 seams to be running an older version of the mod_auth_kerb, and apache when compared to C5. I suspect this is part of the issue I'm sure.<br>
<br>
The other detail i'm having a problem with seams to be related to group membership. On the C4 machine the require group or require ldap-group doesn't seam to work at all. I really don't mind this as much, but if anyone has any ideas i would love to hear what the solution is?<br>
</blockquote>
<br></div>
What does it do/not do? You may need to watch the DS access log while doing an authentication so you can see the query being sent and how many entries (if any) are being returned.<br>
<br>
rob<br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>
Thanks,<br>
<br>
<br>
------------------------------------------------------------------------<br>
<br>
_______________________________________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
</blockquote>
<br>
</blockquote></div></div></div><br>
</blockquote></div><br>