<div dir="ltr"><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Feb 6, 2014 at 11:14 AM, Alexander Bokovoy <span dir="ltr"><<a href="mailto:abokovoy@redhat.com" target="_blank" onclick="window.open('https://mail.google.com/mail/?view=cm&tf=1&to=abokovoy@redhat.com&cc=&bcc=&su=&body=','_blank');return false;">abokovoy@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div>On Thu, 06 Feb 2014, Steve Dainard wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
So I've completed the setup, and can see the trust on the Windows side.<br>
<br>
I've joined a client to the IPA realm, and can login with a IPA user. When<br>
I try to login (console, ssh, su -) as a domain user I get:<br>
<br>
--------CLIENT SIDE--------<br>
<br>
[root@rhel6-client ~]# su - sdainard@miovision<br>
su: user sdainard@miovision does not exist<br>
[root@rhel6-client ~]# su - sdainard@MIOVISION.CORP<br>
su: user sdainard@MIOVISION.CORP does not exist<br>
[root@rhel6-client ~]# su - sdainard@miovision.corp<br>
su: user sdainard@miovision.corp does not exist<br>
<br>
<br>
[root@rhel6-client ~]# ssh sdainard@miovision@localhost<br>
sdainard@miovision@localhost's password:<br>
Permission denied, please try again.<br>
<br>
<br>
/var/log/secure:<br>
Feb 6 10:13:06 rhel6 sshd[2435]: pam_unix(sshd:auth): check pass; user<br>
unknown<br>
Feb 6 10:13:06 rhel6 sshd[2435]: pam_unix(sshd:auth): authentication<br>
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost<br>
Feb 6 10:13:09 rhel6 sshd[2435]: pam_succeed_if(sshd:auth): error<br>
retrieving information about user sdainard@miovision<br>
Feb 6 10:13:10 rhel6 sshd[2435]: Failed password for invalid user<br>
sdainard@miovision from ::1 port 47391 ssh2<br>
Feb 6 10:13:20 rhel6 sshd[2436]: Connection closed by ::1<br>
Feb 6 10:13:25 rhel6 sshd[2709]: Invalid user sdainard@miovision from ::1<br>
Feb 6 10:13:25 rhel6 sshd[2710]: input_userauth_request: invalid user<br>
sdainard@miovision<br>
Feb 6 10:13:36 rhel6 sshd[2709]: pam_unix(sshd:auth): check pass; user<br>
unknown<br>
Feb 6 10:13:36 rhel6 sshd[2709]: pam_unix(sshd:auth): authentication<br>
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost<br>
Feb 6 10:13:38 rhel6 sshd[2709]: pam_succeed_if(sshd:auth): error<br>
retrieving information about user sdainard@miovision<br>
Feb 6 10:13:40 rhel6 sshd[2709]: Failed password for invalid user<br>
sdainard@miovision from ::1 port 47417 ssh2<br>
</blockquote></div></div>
Note that there are no logs from sssd above which means sssd never<br>
consulted.<div><br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
No logs for sssd;<br>
# pwd<br>
/var/log/sssd<br>
[root@snapshot-test sssd]# ll<br>
total 0<br>
-rw-------. 1 root root 0 Feb 5 17:38 krb5_child.log<br>
-rw-------. 1 root root 0 Feb 5 17:38 ldap_child.log<br>
-rw-------. 1 root root 0 Feb 5 17:37 sssd.log<br>
-rw-------. 1 root root 0 Feb 5 17:38 sssd_miolinux.corp.log<br>
-rw-------. 1 root root 0 Feb 5 17:38 sssd_nss.log<br>
-rw-------. 1 root root 0 Feb 5 17:38 sssd_pac.log<br>
-rw-------. 1 root root 0 Feb 5 17:38 sssd_pam.log<br>
-rw-------. 1 root root 0 Feb 5 17:38 sssd_ssh.log<br>
</blockquote></div>
sssd doesn't log if not asked. Each section of /etc/sssd/sssd.conf can<br>
have debug_level = <value><br>
line. For more details see sssd.conf(5).<div><br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
/etc/sssd/sssd.conf:<br>
[domain/miolinux.corp]<br>
<br>
cache_credentials = True<br>
krb5_store_password_if_offline = True<br>
ipa_domain = miolinux.corp<br>
id_provider = ipa<br>
auth_provider = ipa<br>
access_provider = ipa<br>
ipa_hostname = rhel6-client.miolinux.corp<br>
chpass_provider = ipa<br>
ipa_server = _srv_, ipa1.miolinux.corp<br>
ldap_tls_cacert = /etc/ipa/ca.crt<br>
</blockquote></div>
you are missing SSSD configuration for trusts:<br>
<br>
subdomains_provider = ipa<div><br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
[sssd]<br>
services = nss, pam, ssh<br>
</blockquote></div>
and here also service 'pac' has to be referenced in the 'services = '<br>
line<div><br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
config_file_version = 2<br>
<br>
domains = miolinux.corp<br>
[nss]<br>
<br>
[pam]<br>
<br>
[sudo]<br>
<br>
[autofs]<br>
<br>
[ssh]<br>
<br>
[pac]<br>
<br>
<br>
<br>
</blockquote>
<br></div>
Basically, situation should look like this:<br>
<br>
1. IPA master server configured to talk to AD DC, by means of using winbindd in<br>
background (on RHEL 6.x, in current Fedora it is done by directly<br>
talking to AD LDAP services by SSSD). SSSD on IPA master uses it to resolve IDs for AD users<br>
and groups. This requires special setup of SSSD on IPA master, with<br>
<br>
[domain/...]<br>
subdomains_provider = ipa<br>
<br>
and<br>
<br>
[sssd]<br>
services = ..., pac<br></blockquote><div><br></div><div>Server side looks right:</div><div><br></div><div><div>[domain/miolinux.corp]</div><div><br></div><div>cache_credentials = True</div><div>krb5_store_password_if_offline = True</div>
<div>ipa_domain = miolinux.corp</div><div>id_provider = ipa</div><div>auth_provider = ipa</div><div>access_provider = ipa</div><div>ipa_hostname = ipa1.miolinux.corp</div><div>chpass_provider = ipa</div><div>ipa_server = ipa1.miolinux.corp</div>
<div>ldap_tls_cacert = /etc/ipa/ca.crt</div><div>subdomains_provider = ipa</div><div><br></div><div>[sssd]</div><div>services = nss, pam, ssh, pac</div><div>config_file_version = 2</div><div><br></div><div>domains = miolinux.corp</div>
<div>[nss]</div><div><br></div><div>[pam]</div><div><br></div><div>[sudo]</div><div><br></div><div>[autofs]</div><div><br></div><div>[ssh]</div><div><br></div><div>[pac]</div></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
In newer versions (FreeIPA 3.3+, SSSD 1.11+) this is done on IPA master<br>
automatically by setting ipa_master_mode = True<br>
<br>
On RHEL 6.x one needs to add the parameters manually.<br>
<br>
2. /etc/krb5.conf has to contain auth_to_local rules that map AD<br>
principals to lower-cased versions because some applications (SSH)<br>
are very picky about user/principal name mapping. This has to be done<br>
on both IPA masters and IPA clients.<br></blockquote><div><br></div><div>This was done on the IPA server, but the RHEL 6.5 client doesn't have this file.</div><div><br></div><div>On the IPA server: </div><div><br>
</div><div><div>[realms]</div><div> MIOLINUX.CORP = {</div><div> kdc = ipa1.miolinux.corp:88</div><div> master_kdc = ipa1.miolinux.corp:88</div><div> admin_server = ipa1.miolinux.corp:749</div><div> default_domain = miolinux.corp</div>
<div> pkinit_anchors = FILE:/etc/ipa/ca.crt</div><div>auth_to_local = RULE:[1:$1@$0](^.*@MIOVISION$)s/@MIOVISION/@miovision/</div><div>auth_to_local = DEFAULT</div></div><div><br></div><div><div>[root@ipa1 ~]# kinit sdainard@miovision.corp</div>
<div>Password for sdainard@miovision.corp: </div><div>kinit: KDC reply did not match expectations while getting initial credentials</div></div><div><br></div><div><br></div><div><br></div><div>A CentOS 6.5 client has this file. The docs didn't mention the manual client config, I just assumed the IPA server would proxy the request. After adding, no change.</div>
<div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
3. On IPA clients SSSD needs to have following in the<br>
/etc/sssd/sssd.conf<br>
<br>
[domain/...]<br>
subdomains_provider = ipa<br>
<br>
and<br>
<br>
[sssd]<br>
services = ..., pac<br></blockquote><div><br></div><div>Added.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
With these changes SSSD on IPA client will recognize AD users and<br>
request IPA master to perform name/SID/etc resolution, and also will<br>
make an attempt to parse special part of the Kerberos ticket<br>
generated by AD DC (MS-PAC) that contains signed cached copy of group<br>
ownership for AD users.<br>
<br>
SSSD needs restart after each config change.<br>
<br>
You can do checks step by step to see whether things are working:<br>
<br>
1. Ensure that SSSD on IPA master resolves AD user properly:<br>
<br>
getent passwd user@ad.domain<br>
<br>
Should return non-empty entry.<br></blockquote><div><br></div><div>Returns no values.</div><div><br></div><div><div>[root@ipa1 ~]# getent passwd sdainard@miovision.corp</div><div>[root@ipa1 ~]# </div></div><div><br></div>
<div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
2. Ensure that SSSD on IPA client resolves AD user properly:<br>
<br>
getent passwd user@ad.domain<br>
<br>
Should return non-empty entry.<br></blockquote><div><br></div><div><div>[root@snapshot-test ~]# getent passwd sdainard@miovision.corp</div><div>[root@snapshot-test ~]# </div></div><div><br></div><div><br></div><div> </div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
3. Ensure that Kerberos infrastructure works:<br>
<br>
kinit user@ad.domain<br>
kvno -S host ipa.client.domain<br></blockquote><div><br></div><div><div>[root@ipa1 ~]# kinit sdainard@miovision.corp</div><div>Password for sdainard@miovision.corp: </div><div>kinit: KDC reply did not match expectations while getting initial credentials</div>
<div><br></div><div>[root@ipa1 ~]# kinit sdainard@MIOVISION.CORP</div><div>Password for sdainard@MIOVISION.CORP: </div><div><br></div><div>[root@ipa1 ~]# kvno cifs/dc1.miovision.corp@MIOVISION.CORP<br></div><div>cifs/dc1.miovision.corp@MIOVISION.CORP: kvno = 41</div>
<div><br></div><div><div>[root@ipa1 ~]# kvno -S host ipa1.miolinux.corp</div><div>host/ipa1.miolinux.corp@MIOLINUX.CORP: kvno = 2</div><div><br></div><div>[root@ipa1 ~]# klist</div><div>Ticket cache: FILE:/tmp/krb5cc_0</div>
<div>Default principal: sdainard@MIOVISION.CORP</div><div><br></div><div>Valid starting Expires Service principal</div><div>02/06/14 11:54:55 02/06/14 21:54:57 krbtgt/MIOVISION.CORP@MIOVISION.CORP</div><div>
<span style="white-space:pre-wrap"> </span>renew until 02/07/14 11:54:55</div><div>02/06/14 11:55:38 02/06/14 21:54:57 cifs/dc1.miovision.corp@MIOVISION.CORP</div><div><span style="white-space:pre-wrap"> </span>renew until 02/07/14 11:54:55</div>
<div>02/06/14 11:56:50 02/06/14 21:54:57 krbtgt/MIOLINUX.CORP@MIOVISION.CORP</div><div><span style="white-space:pre-wrap"> </span>renew until 02/07/14 11:54:55</div><div>02/06/14 11:57:05 02/06/14 21:54:57 host/ipa1.miolinux.corp@MIOLINUX.CORP</div>
<div><span style="white-space:pre-wrap"> </span>renew until 02/07/14 11:54:55</div></div></div><div><br></div><div>It appears the rewrite rules in krb5.conf are not working, not sure what I missed.</div><div><br></div><div>
</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
4. Attempt to use Kerberos ticket:<br>
<br>
ssh -l user@ad.domain ipa.client.domain<br>
<br>
At this point if everything works fine, SSHd will authenticate<br>
user@ad.domain by its Kerberos ticket and authorize its access.<span><font color="#888888"><br>
<br>
<br>
-- <br>
/ Alexander Bokovoy<br>
</font></span></blockquote></div><br></div></div>