<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;">Details:<br></div><div style="" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;"><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;">ipa-client-install --version</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;">4.2.0</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt;"><br></div><div><div>sssd --version</div><div>1.13.0</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt;"><br></div></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;"><div style="font-size: 12pt;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;">krb5-config --version</div><div style="font-size: 12pt;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;">Kerberos 5 release 1.13.2</div><div><br></div></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;"><div style="font-size: 12pt;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;">cat /etc/redhat-release</div><div style="font-size: 12pt;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;">CentOS Linux release 7.2.1511 (Core)</div><div><br></div></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;">I hope this helps, also can I disable the allow-all rule per-host?</div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;"><br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;">Thanks,</div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;">Jake<br><br><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>From: </b>"Lachlan Musicman" <datakid@gmail.com><br><b>Cc: </b>"freeipa-users" <freeipa-users@redhat.com><br><b>Sent: </b>Tuesday, November 1, 2016 7:04:45 PM<br><b>Subject: </b>Re: [Freeipa-users] HBAC Troubleshooting (IPA 4.2)<br></div><br><div data-marker="__QUOTED_TEXT__"><div dir="ltr"><div><div><div><div><div><div><div><div><div>Jake,<br><br></div><div>I've seen this behaviour and am still struggling to find a solution.<br><br></div>The version of underlying OS and sssd are useful to know fwiw.<br><br></div>To trouble shoot HBAC:<br><br></div> - in *target machine* sssd.conf, add debug_level=7 to each stanza (can go as high as 9, but I believe 7 will be sufficient)<br></div> - restart sssd<br></div> - clear logs in /var/log/sssd/ either by deleting or by logrotate<br></div> - make an attempt to login/perform allowed action that gets denied<br></div> - read logs to see what happened<br></div><div> - I like to run `ipa hbactest --user= --host= --service` on the IPA node to confirm that the HBAC rules are correct<br></div><div> - I sometimes also install ipa-tools on the target host and confirm that the above command gives same and correct answer<br></div><div> - note that successful results from this command may not translate to successful application of HBAC on the target host in reality.<br></div><br><br><br>cheers<br></div>L.<br><div><div><div><div><div><div><br></div></div></div></div></div></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div>------<br>The most dangerous phrase in the language is, "We've always done it this way."<br><br>- Grace Hopper<br></div></div></div></div> <br><div class="gmail_quote">On 2 November 2016 at 09:41, Jake <span dir="ltr"><<a href="mailto:freeipa@jacobdevans.com" target="_blank">freeipa@jacobdevans.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;" data-mce-style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;"><div><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;"><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;">Hey All,<br></div><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;">I'm having some issues tracing HBAC policies, it seems whenever I disable the allow_all policy, I'm no longer able to access services I have allowed in my more-specific hbac policy.</div><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;"><br></div><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;">What are the troubleshooting steps (logs) I can run on the client to see what is being denied and by what policy, Is this all done with sssd?</div><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;"><br></div><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;">Thank You,</div><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;">-Jake</div><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;"><br></div></div></div><br>--<br> Manage your subscription for the Freeipa-users mailing list:<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br> Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br></blockquote></div><br></div> <br>-- <br>Manage your subscription for the Freeipa-users mailing list:<br>https://www.redhat.com/mailman/listinfo/freeipa-users<br>Go to http://freeipa.org for more info on the project</div></div><br></div></body></html>