<div dir="ltr"><div>Hi List</div><div> </div><div>I'm currently running IPA 3.3 on Centos 7, and successfully authenticating Linux clients (Centos 6.5). </div><div> </div><div>I'd like to setup Solaris 10 as an IPA client, but this seems problematic. I am following this guide:</div><div> </div><div><a href="http://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Solaris.html#Configuring_an_IPA_Client_on_Solaris_10" target="_blank">http://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Solaris.html#Configuring_an_IPA_Client_on_Solaris_10</a></div><div> </div><div>I have the following setup:</div><div> </div><div>Solaris client: </div><div> </div><div>- Solaris 10u11 (SunOS 5.10 Generic_147148-26 i86pc i386 i86pc)</div><div> </div><div>IdM Server:</div><div> </div><div>- Linux kwtpocipa001.orion.local 3.10.0-123.el7.x86_64 #1 SMP Mon Jun 30 12:09:22 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux</div><div> </div><div> </div><div> </div><div>Going through the steps in the guide: at step 3 ("Create the cn=proxyagent account"), ldapadd fails with the following error:</div><div> </div><div> </div><div> </div><div>"ldapadd: invalid format (line 6) entry: "cn=proxyagent,ou=profile,dc=orion,dc=local""</div><div> </div><div>---</div><div> </div><div>[root@kwtpocipa001 ~]# ldapadd -h 172.16.107.102 -p 389 -D "cn=directory manager" -w Cr4ckM0nk3y</div><div>dn: cn=proxyagent,ou=profile,dc=orion,dc=local<br>objectClass: top<br>objectClass: person<br>sn: proxyagent<br>cn: proxyagent<br>userPassword:: e1NTSEF9Mm53KytGeU81Z1dka1FLNUZlaDdXOHJkK093TEppY2NjRmt6Wnc9PQ=</div><div> </div><div>ldapadd: invalid format (line 6) entry: "cn=proxyagent,ou=profile,dc=orion,dc=local"<br></div><div>---</div><div> </div><div>I've made the assumption that the extra ":" is a typo in the documentation and removed it, so the command runs successfully as follows:</div><div> </div><div> </div><div>---</div><div>[root@kwtpocipa001 ~]# ldapadd -h 172.16.107.102 -p 389 -D "cn=directory manager" -w Cr4ckM0nk3y</div><div> </div><div>dn: cn=proxyagent,ou=profile,dc=orion,dc=local<br>objectClass: top<br>objectClass: person<br>sn: proxyagent<br>cn: proxyagent<br>userPassword: e1NTSEF9Mm53KytGeU81Z1dka1FLNUZlaDdXOHJkK093TEppY2NjRmt6Wnc9PQ=</div><div>adding new entry "cn=proxyagent,ou=profile,dc=orion,dc=local"<br>---</div><div> </div><div> </div><div>At step 9 (Configure NFS ), I get an error, seems to indicate the "des-cbc-crc" encryption type is unsupported:</div><div> </div><div>---</div><div>[root@kwtpocipa001 ~]# ipa-getkeytab -s kwtpocipa001.orion.local -p nfs/kwtpocipasol10u11.orion.local -k /tmp/kwtpocipasol10u11.keytab -e des-cbc-crc<br>Operation failed! All enctypes provided are unsupported<br>[root@kwtpocipa001 ~]#<br>---</div><div> </div><div>(Question: How would I add support for des-cbc-crc encryption in freeipa?). I've now worked around this by not specifying any encryption type:</div><div> </div><div>---</div><div>[root@kwtpocipa001 ~]# ipa-getkeytab -s kwtpocipa001.orion.local -p nfs/kwtpocipasol10u11.orion.local -k /tmp/kwtpocipasol10u11.keytab<br>Keytab successfully retrieved and stored in: /tmp/kwtpocipasol10u11.keytab<br>[root@kwtpocipa001 ~]#</div><div>---</div><div> </div><div>Testing that I can see nfs mounts on the centos IPA server from the solaris machine:</div><div> </div><div>---</div><div>bash-3.2# showmount -e kwtpocipa001.orion.local<br>export list for kwtpocipa001.orion.local:<br>/data/centos-repo <a href="http://172.16.0.0/24">172.16.0.0/24</a><br>bash-3.2#<br>----</div><div> </div><div> </div><div>Checking we can kinit:</div><div> </div><div>---</div><div>bash-3.2#<br>bash-3.2# kinit admin<br>Password for <a href="mailto:admin@ORION.LOCAL">admin@ORION.LOCAL</a>:<br>bash-3.2#<br>bash-3.2#<br>bash-3.2# klist<br>Ticket cache: FILE:/tmp/krb5cc_0<br>Default principal: <a href="mailto:admin@ORION.LOCAL">admin@ORION.LOCAL</a></div><div>Valid starting Expires Service principal<br>09/24/14 11:20:36 09/24/14 12:20:36 <a href="mailto:krbtgt/ORION.LOCAL@ORION.LOCAL">krbtgt/ORION.LOCAL@ORION.LOCAL</a><br> renew until 10/01/14 11:20:36<br>bash-3.2#<br>bash-3.2#<br>bash-3.2#<br>bash-3.2# uname -a<br>SunOS kwtpocipasol10u11 5.10 Generic_147148-26 i86pc i386 i86pc<br>bash-3.2#<br>---</div><div> </div><div>Testing I can mount the remote FS (without Kerberos auth). This is successful (when not using kerberos5 authentication):</div><div> </div><div>---</div><div>bash-3.2# mount -F nfs 172.16.107.102:/data/centos-repo /remote/<br>bash-3.2# mount |grep remote<br>/remote on 172.16.107.102:/data/centos-repo remote/read/write/setuid/devices/rstchown/xattr/dev=4f0000a on Wed Sep 24 13:45:32 2014<br>bash-3.2#<br></div><div>---</div><div> </div><div>Testing with KRB5:</div><div> </div><div>---</div><div>bash-3.2# mount -F nfs -o sec=krb5 172.16.107.102:/data/centos-repo /remote/<br>nfs mount: mount: /remote: Permission denied<br>bash-3.2#<br>---</div><div> </div><div>Looking at the krbkdc logs on the IPA master server, I get the following error:</div><div> </div><div>---</div><div>Sep 24 13:48:17 kwtpocipa001.orion.local krb5kdc[2371](info): AS_REQ (6 etypes {18 17 16 23 3 1}) <a href="http://172.16.107.107">172.16.107.107</a>: NEEDED_PREAUTH: <a href="mailto:host/kwtpocipasol10u11.orion.local@ORION.LOCAL">host/kwtpocipasol10u11.orion.local@ORION.LOCAL</a> for <a href="mailto:krbtgt/ORION.LOCAL@ORION.LOCAL">krbtgt/ORION.LOCAL@ORION.LOCAL</a>, Additional pre-authentication required<br>Sep 24 13:48:17 kwtpocipa001.orion.local krb5kdc[2373](info): DISPATCH: repeated (retransmitted?) request from 172.16.107.107, resending previous response<br>Sep 24 13:48:17 kwtpocipa001.orion.local krb5kdc[2374](info): DISPATCH: repeated (retransmitted?) request from 172.16.107.107, resending previous response<br>.</div><div>.</div><div>.</div><div>Sep 24 13:48:18 kwtpocipa001.orion.local krb5kdc[2373](info): AS_REQ (6 etypes {18 17 16 23 3 1}) <a href="http://172.16.107.107">172.16.107.107</a>: CLIENT_NOT_FOUND: <a href="mailto:root/kwtpocipasol10u11.orion.local@ORION.LOCAL">root/kwtpocipasol10u11.orion.local@ORION.LOCAL</a> for <a href="mailto:krbtgt/ORION.LOCAL@ORION.LOCAL">krbtgt/ORION.LOCAL@ORION.LOCAL</a>, Client not found in Kerberos database<br><br>---</div><div> </div><div>So it seems the host is not correctly registered.</div><div> </div><div>NOTE: Via the interface ,I can see the solaris client is not properly enrolled ("<span style="display:inline" name="missing"> Kerberos Key Not Present</span>"), however the documentation doesn't seem to indicate clearly how this should be done for a Solaris client. I have regenerated the certificate though, so it shows "valid certificate present".</div><div> </div><div>My question is: Is the process described in this guide still correct/functional for integrating Solaris 10 clients? </div><div>If so, is there some way I could debug further to pinpoint why the solaris client is not being registered in the Kerberos DB?</div><div> </div><div>Many thanks in advance!</div><div>Traiano</div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div><br> </div></div>