<div dir="ltr"><div>Hi Martin</div><div> </div><div><br> </div><div class="gmail_quote">On Wed, Sep 24, 2014 at 2:18 PM, Martin Kosek <span dir="ltr"><<a href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><div><div>On 09/24/2014 01:06 PM, Traiano Welcome wrote:<br> > Hi List<br> ><br> > I'm currently running IPA 3.3 on Centos 7, and successfully authenticating<br> > Linux clients (Centos 6.5).<br> ><br> > I'd like to setup Solaris 10 as an IPA client, but this seems<br> > problematic. I am following this guide:<br> ><br> > <a href="http://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Solaris.html#Configuring_an_IPA_Client_on_Solaris_10" target="_blank">http://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Solaris.html#Configuring_an_IPA_Client_on_Solaris_10</a><br> ><br> > I have the following setup:<br> ><br> > Solaris client:<br> ><br> > - Solaris 10u11 (SunOS 5.10 Generic_147148-26 i86pc i386 i86pc)<br> ><br> > IdM Server:<br> ><br> > - Linux kwtpocipa001.orion.local 3.10.0-123.el7.x86_64 #1 SMP Mon Jun 30<br> > 12:09:22 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux<br> ><br> ><br> ><br> > Going through the steps in the guide: at step 3 ("Create the cn=proxyagent<br> > account"), ldapadd fails with the following error:<br> ><br> ><br> ><br> > "ldapadd: invalid format (line 6) entry:<br> > "cn=proxyagent,ou=profile,dc=orion,dc=local""<br> ><br> > ---<br> ><br> > [root@kwtpocipa001 ~]# ldapadd -h 172.16.107.102 -p 389 -D "cn=directory<br> > manager" -w Cr4ckM0nk3y<br> > dn: cn=proxyagent,ou=profile,dc=orion,dc=local<br> > objectClass: top<br> > objectClass: person<br> > sn: proxyagent<br> > cn: proxyagent<br> > userPassword::<br> > e1NTSEF9Mm53KytGeU81Z1dka1FLNUZlaDdXOHJkK093TEppY2NjRmt6Wnc9PQ=<br> ><br> > ldapadd: invalid format (line 6) entry:<br> > "cn=proxyagent,ou=profile,dc=orion,dc=local"<br> > ---<br> ><br> > I've made the assumption that the extra ":" is a typo in the documentation<br> > and removed it, so the command runs successfully as follows:<br> ><br> ><br> > ---<br> > [root@kwtpocipa001 ~]# ldapadd -h 172.16.107.102 -p 389 -D "cn=directory<br> > manager" -w Cr4ckM0nk3y<br> ><br> > dn: cn=proxyagent,ou=profile,dc=orion,dc=local<br> > objectClass: top<br> > objectClass: person<br> > sn: proxyagent<br> > cn: proxyagent<br> > userPassword:<br> > e1NTSEF9Mm53KytGeU81Z1dka1FLNUZlaDdXOHJkK093TEppY2NjRmt6Wnc9PQ=<br> > adding new entry "cn=proxyagent,ou=profile,dc=orion,dc=local"<br> > ---<br> ><br> ><br> > At step 9 (Configure NFS ), I get an error, seems to indicate the<br> > "des-cbc-crc" encryption type is unsupported:<br> ><br> > ---<br> > [root@kwtpocipa001 ~]# ipa-getkeytab -s kwtpocipa001.orion.local -p<br> > nfs/kwtpocipasol10u11.orion.local -k /tmp/kwtpocipasol10u11.keytab -e<br> > des-cbc-crc<br> > Operation failed! All enctypes provided are unsupported<br> > [root@kwtpocipa001 ~]#<br> > ---<br> ><br> > (Question: How would I add support for des-cbc-crc encryption in<br> > freeipa?). I've now worked around this by not specifying any encryption<br> > type:<br> ><br> > ---<br> > [root@kwtpocipa001 ~]# ipa-getkeytab -s kwtpocipa001.orion.local -p<br> > nfs/kwtpocipasol10u11.orion.local -k /tmp/kwtpocipasol10u11.keytab<br> > Keytab successfully retrieved and stored in: /tmp/kwtpocipasol10u11.keytab<br> > [root@kwtpocipa001 ~]#<br> > ---<br> ><br> > Testing that I can see nfs mounts on the centos IPA server from the solaris<br> > machine:<br> ><br> > ---<br> > bash-3.2# showmount -e kwtpocipa001.orion.local<br> > export list for kwtpocipa001.orion.local:<br> > /data/centos-repo <a href="http://172.16.0.0/24" target="_blank">172.16.0.0/24</a><br> > bash-3.2#<br> > ----<br> ><br> ><br> > Checking we can kinit:<br> ><br> > ---<br> > bash-3.2#<br> > bash-3.2# kinit admin<br> > Password for admin@ORION.LOCAL:<br> > bash-3.2#<br> > bash-3.2#<br> > bash-3.2# klist<br> > Ticket cache: FILE:/tmp/krb5cc_0<br> > Default principal: admin@ORION.LOCAL<br> > Valid starting Expires Service principal<br> > 09/24/14 11:20:36 09/24/14 12:20:36 krbtgt/ORION.LOCAL@ORION.LOCAL<br> > renew until 10/01/14 11:20:36<br> > bash-3.2#<br> > bash-3.2#<br> > bash-3.2#<br> > bash-3.2# uname -a<br> > SunOS kwtpocipasol10u11 5.10 Generic_147148-26 i86pc i386 i86pc<br> > bash-3.2#<br> > ---<br> ><br> > Testing I can mount the remote FS (without Kerberos auth). This is<br> > successful (when not using kerberos5 authentication):<br> ><br> > ---<br> > bash-3.2# mount -F nfs 172.16.107.102:/data/centos-repo /remote/<br> > bash-3.2# mount |grep remote<br> > /remote on 172.16.107.102:/data/centos-repo<br> > remote/read/write/setuid/devices/rstchown/xattr/dev=4f0000a on Wed Sep 24<br> > 13:45:32 2014<br> > bash-3.2#<br> > ---<br> ><br> > Testing with KRB5:<br> ><br> > ---<br> > bash-3.2# mount -F nfs -o sec=krb5 172.16.107.102:/data/centos-repo /remote/<br> > nfs mount: mount: /remote: Permission denied<br> > bash-3.2#<br> > ---<br> ><br> > Looking at the krbkdc logs on the IPA master server, I get the following<br> > error:<br> ><br> > ---<br> > Sep 24 13:48:17 kwtpocipa001.orion.local krb5kdc[2371](info): AS_REQ (6<br> > etypes {18 17 16 23 3 1}) <a href="http://172.16.107.107" target="_blank">172.16.107.107</a>: NEEDED_PREAUTH:<br> > host/kwtpocipasol10u11.orion.local@ORION.LOCAL for<br> > krbtgt/ORION.LOCAL@ORION.LOCAL, Additional pre-authentication required<br> > Sep 24 13:48:17 kwtpocipa001.orion.local krb5kdc[2373](info): DISPATCH:<br> > repeated (retransmitted?) request from 172.16.107.107, resending previous<br> > response<br> > Sep 24 13:48:17 kwtpocipa001.orion.local krb5kdc[2374](info): DISPATCH:<br> > repeated (retransmitted?) request from 172.16.107.107, resending previous<br> > response<br> > .<br> > .<br> > .<br> > Sep 24 13:48:18 kwtpocipa001.orion.local krb5kdc[2373](info): AS_REQ (6<br> > etypes {18 17 16 23 3 1}) <a href="http://172.16.107.107" target="_blank">172.16.107.107</a>: CLIENT_NOT_FOUND:<br> > root/kwtpocipasol10u11.orion.local@ORION.LOCAL for<br> > krbtgt/ORION.LOCAL@ORION.LOCAL, Client not found in Kerberos database<br> ><br> > ---<br> ><br> > So it seems the host is not correctly registered.<br> ><br> > NOTE: Via the interface ,I can see the solaris client is<br> > not properly enrolled (" Kerberos Key Not Present"), however the<br> > documentation doesn't seem to indicate clearly how this should be done for<br> > a Solaris client. I have regenerated the certificate though, so it shows<br> > "valid certificate present".<br> ><br> > My question is: Is the process described in this guide still<br> > correct/functional for integrating Solaris 10 clients?<br> > If so, is there some way I could debug further to pinpoint why the solaris<br> > client is not being registered in the Kerberos DB?<br> ><br> > Many thanks in advance!<br> > Traiano<br> <br> </div></div>Hello Traiano,<br> <br> This part of the documentation is wrong, as reported by ldapadd, userpassword<br> is not correct.<br> <br> If you specify the entry with clear text password, it would work. I.e.:<br> <span><br> dn: cn=proxyagent,ou=profile,dc=orion,dc=local<br> objectClass: top<br> objectClass: person<br> sn: proxyagent<br> cn: proxyagent<br> </span>userPassword: agentpassword<br> <br> Note that Solaris related documentation is (unfortunately) known to be off:<br> <a href="https://fedorahosted.org/freeipa/ticket/3731" target="_blank">https://fedorahosted.org/freeipa/ticket/3731</a><br> <br> Also please note that the guide you are referring to is also pretty old (from<br> Fedora 18 times) and not updated. There is a related thread:<br> <br> <a href="https://www.redhat.com/archives/freeipa-users/2014-September/msg00357.html" target="_blank">https://www.redhat.com/archives/freeipa-users/2014-September/msg00357.html</a><br> </blockquote><div> </div><div> </div><div>Indeed. There are some minor errata as well like the use of the "-t" flag with Solaris' version of the mount command:</div><div> </div><div>bash-3.2# mount -t nfs -o sec=krb5 172.16.107.102:/data/centos-repo /remote/<br>mount: illegal option -- t<br></div><div> "-F" works.</div><div> </div><div> </div><div>I've adjusted the steps I've used to include the changes you mentioned in <a href="https://fedorahosted.org/freeipa/ticket/3731">https://fedorahosted.org/freeipa/ticket/3731</a>, attached is a step by step listing of the process with my output up to step 9, where mounting NFS fails. </div><div>Hopefully by a process of iteration I can document the updated process for configuring Solaris 10 clients.</div><div> </div><div>Here is what I'm seeing at step 9 (referencing the old Fedora 18 docs with adjusted steps)L</div><div> </div><div> </div><div>h) Mount the NFS share. [FAILS]</div><div>---<br>bash-3.2# mount -F nfs -o sec=krb5 172.16.107.102:/data/centos-repo /remote/<br>nfs mount: mount: /remote: Permission denied<br>bash-3.2#<br>---</div><div>/var/log/krbkdc.Log entries:</div><div>---<br>krb5kdc: Cannot determine realm for numeric host address - unable to find<br>realm of host<br>Sep 25 18:18:20 kwtpocipa001.orion.local krb5kdc[2373](info): TGS_REQ (6<br>etypes {18 17 16 23 3 1}) <a href="http://172.16.107.107">172.16.107.107</a>: LOOKING_UP_SERVER: authtime 0,<br><a href="mailto:admin@ORION.LOCAL">admin@ORION.LOCAL</a> for <unknown server>, Server not found in Kerberos database<br>Sep 25 18:18:20 kwtpocipa001.orion.local krb5kdc[2373](info): TGS_REQ (6<br>etypes {18 17 16 23 3 1}) <a href="http://172.16.107.107">172.16.107.107</a>: LOOKING_UP_SERVER: authtime 0,<br><a href="mailto:admin@ORION.LOCAL">admin@ORION.LOCAL</a> for <unknown server>, Server not found in Kerberos database<br>krb5kdc: Cannot determine realm for numeric host address - unable to find<br>realm of host<br>Sep 25 18:18:20 kwtpocipa001.orion.local krb5kdc[2373](info): TGS_REQ (6<br>etypes {18 17 16 23 3 1}) <a href="http://172.16.107.107">172.16.107.107</a>: LOOKING_UP_SERVER: authtime 0,<br><a href="mailto:admin@ORION.LOCAL">admin@ORION.LOCAL</a> for <unknown server>, Server not found in Kerberos database<br>Sep 25 18:18:20 kwtpocipa001.orion.local krb5kdc[2373](info): TGS_REQ (6<br>etypes {18 17 16 23 3 1}) <a href="http://172.16.107.107">172.16.107.107</a>: LOOKING_UP_SERVER: authtime 0,<br><a href="mailto:admin@ORION.LOCAL">admin@ORION.LOCAL</a> for <unknown server>, Server not found in Kerberos database<br>krb5kdc: Cannot determine realm for numeric host address - unable to find<br>realm of host<br>Sep 25 18:18:20 kwtpocipa001.orion.local krb5kdc[2373](info): TGS_REQ (6<br>etypes {18 17 16 23 3 1}) <a href="http://172.16.107.107">172.16.107.107</a>: LOOKING_UP_SERVER: authtime 0,<br><a href="mailto:admin@ORION.LOCAL">admin@ORION.LOCAL</a> for <unknown server>, Server not found in Kerberos database<br>Sep 25 18:18:20 kwtpocipa001.orion.local krb5kdc[2373](info): TGS_REQ (6<br>etypes {18 17 16 23 3 1}) <a href="http://172.16.107.107">172.16.107.107</a>: LOOKING_UP_SERVER: authtime 0,<br><a href="mailto:admin@ORION.LOCAL">admin@ORION.LOCAL</a> for <unknown server>, Server not found in Kerberos database<br>---</div><div><br>However DNS forward and reverse records DO seem to resolve:</div><div>---<br>[root@kwtpocipa001 ~]# host 172.16.107.107<br>107.107.16.172.in-addr.arpa domain name pointer kwtpocipasol10u11.orion.local.<br>[root@kwtpocipa001 ~]# host kwtpocipasol10u11.orion.local<br>kwtpocipasol10u11.orion.local has address 172.16.107.107<br>--- </div><div> </div><div><br>And we can kinit and get a ticket:</div><div> </div><div> </div><div>---<br>bash-3.2# kinit <a href="mailto:admin@ORION.LOCAL">admin@ORION.LOCAL</a><br>Password for <a href="mailto:admin@ORION.LOCAL">admin@ORION.LOCAL</a>:<br>bash-3.2#<br>bash-3.2#<br>bash-3.2# klist<br>Ticket cache: FILE:/tmp/krb5cc_0<br>Default principal: <a href="mailto:admin@ORION.LOCAL">admin@ORION.LOCAL</a></div><div>Valid starting Expires Service principal<br>09/25/14 18:31:49 09/25/14 19:31:49 <a href="mailto:krbtgt/ORION.LOCAL@ORION.LOCAL">krbtgt/ORION.LOCAL@ORION.LOCAL</a><br> renew until 10/02/14 18:31:49<br>bash-3.2#<br>---</div><div> </div><div> </div><div>Regards,</div><div>Traiano</div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><span><font color="#888888"><br> Martin<br> </font></span></blockquote></div><br></div>