[Freeipa-users] [SOLVED] Unable to establish trust with FreeIPA and Active Directory

[Alexander Bokovoy]

On Fri, 04 Apr 2014, Alexander Bokovoy wrote:
>>tevent: Destroying timer event 0x7facb82e9d30
>>"dcerpc_connect_timeout_handler"
>^^ stopped just short of authenticating to smbd prior to ask it for
>informational policy about the domain.
>
>This means there is some problem in what smbd thinks about your
>admin at UNIX account.
>
>Can you do following:
>
># for i in /var/log/samba/log.* ; do echo > $i ; done
># smbcontrol all debug 100
># kinit admin at UNIX
># ipa trust-add sbx.local ....
># smbcontrol all debug 1
>
>now archive logs in /var/log/samba/log.* and send them to me privately.

After several rounds of capturing logs, we've solved the issue by
finding out that IPv6 stack was completely disabled on the machine.

Even though certain security guides may suggest disabling IPv6 stack
when it is not in use, this suggestion is not very usable. IPv4 and IPv6
share the same port range on the local side, so it is a recommended
programming practice for networking applications to only open IPv6
sockets. Standard C library (glibc, for example) handles transparently
both IPv4 and IPv6 cases for the applications.

Samba and some of other FreeIPA components open their networking sockets
as IPv6 ones. Completely disabling IPv6 stack on the machine causes
these requests to open a socket to fail as kernel will be responding "do
not know this socket address family".

If your security guidelines require disabling IPv6 address space, please
don't add ipv6.disable=1 to the kernel commandline to disable the whole
IPv6 stack. Instead, use ipv6.disable_ipv6=1. The latter option will
keep the IPv6 stack functional but will not assign IPv6 addresses to any
of your network devices. This is recommended approach for cases when
you don't use IPv6 networking.

Creating and adding to, for example, /etc/sysctl.d/ipv6.conf will avoid
assigning IPv6 addresses to a specific network interface:

  # Disable IPv6
  net.ipv6.conf.all.disable_ipv6 = 1
  net.ipv6.conf.<interface0>.disable_ipv6 = 1

where interface0 is your specialized interface. Note that all we are
requiring is that IPv6 stack is enabled at the kernel level and this
is recommended way to develop networking applications for a long time
already. 

I've updated http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup and 
http://www.freeipa.org/page/Deployment_Recommendations with this
information. 


-- 
/ Alexander Bokovoy