subject:"Re\\\: \\\[Freeipa\\\-users\\\] No result when trying to integrate a FreeBSD client with the FreeIPA server"

Replying to myself is great... Anyway, maybe this info will be useful 
for people like me, trying to integrate FreeBSD with FreeIPA.


Solved some problems:

1. SSH-ing as existing IPA user rsiwal to my FreeBSD client fails. 
The same user can SSH or locally login to my Linux client. 


That happened because the shell specified for user rsiwal was 
/bin/bash. After changing it to /bin/sh that problem disappeared.


2. At the same time I cannot locally login to my FreeBSD host as either 
IPA user or local user.


I posted the cause and solution at FreeBSD forums: 
https://forums.freebsd.org/threads/freebsd-freeipa-via-sssd.46526/


3. If I create a new user in IPA, he can`t initially SSH into FreeBSD 
client.

BSD says: password expired, but doesn`t take new password.
The same new user can SSH into my Linux client.
Linux says: password expired and allows to set a new password with a 
message: All authentication tokens updated successfully.
After I set a new password for my newly created user via Linux, I can 
SSH into my BSD client as that user.
Using this hack I can create new users in IPA, SSH into Linux to change 
their passwords and then use those new users to SSH into FreeBSD.


Didn`t find a solution yet. But I think this is caused by lack of proper 
configuration of Kerberos on my FreeBSD client. On my Linux client I 
found such a configuration in /etc/krb5.conf file. However, there's no 
such file on my FreeBSD client, as the post on FreeBSD forums didn't say 
anything about such a file. I'll do some more checks and share the 
results here.



16-Oct-14 18:23, Orkhan Gasimov пишет:

Here`s what I have at the end of the day after various checks.

SSH-ing as existing IPA user rsiwal to my FreeBSD client fails.
The same user can SSH or locally login to my Linux client.
If I create a new user in IPA, he can`t initially SSH into FreeBSD 
client.

BSD says: password expired, but doesn`t take new password.
The same new user can SSH into my Linux client.
Linux says: password expired and allows to set a new password with a 
message: All authentication tokens updated successfully.
After I set a new password for my newly created user via Linux, I can 
SSH into my BSD client as that user.
Using this hack I can create new users in IPA, SSH into Linux to 
change their passwords and then use those new users to SSH into FreeBSD.
At the same time I cannot locally login to my FreeBSD host as either 
IPA user or local user.


I think there`s something wrong with Kerberos setup on my FreeBSD 
client. I suspect that because both /etc/pam.d/system and 
/etc/pam.d/sshd files on the BSD client have a string:

password  sufficient  /usr/local/lib/pam_sss.so use_authtok
but BSD doesn`t let update authentication tokens when trying to change 
expired password for a new user.


There was minimal info about Kerberos setup on FreeBSD client in the 
post at FreeBSD forums. Just this: create a keytab on the IPA server 
and copy it to /etc/krb5.keytab on the FreeBSD client.


Someone here wrote that he can contact the author of that post. If so, 
please tell the author to spend a couple of hours to:

1) check everything he advised on a blank setup with VMs;
2) provide more details about correct sequence of actions.

Any help will be highly appreciated!

16-Oct-14 15:13, Orkhan Gasimov пишет:
Please excuse me for that silly typo in the letter. The typo doesn`t 
exist either in /etc/pam.d/system or /etc/pam.d/sshd - in those files 
I typed ignore_unknown_user.


I'll try ignore_authinfo_unavail to see if it prevents me from 
being locked out of the machine.


Here are the log files:

sssd_eurosel.az.log: 
https://cloud.mail.ru/public/1e803a00989e%2Fsssd_eurosel.az.log

sssd_nss.log: https://cloud.mail.ru/public/ae41ae3b44b6%2Fsssd_nss.log
sssd_pam.log: https://cloud.mail.ru/public/85d311ec1d4e%2Fsssd_pam.log
krb5_child.log: 
https://cloud.mail.ru/public/c0e6712b7f1b%2Fkrb5_child.log
ldap_child.log: 
https://cloud.mail.ru/public/d9b0b1eb0da6%2Fldap_child.log

sssd_log: https://cloud.mail.ru/public/d4032b8e6645%2Fsssd.log


16-Oct-14 14:57, Lukas Slebodnik пишет:

On (16/10/14 13:04), Orkhan Gasimov wrote:

OK, back to FreeIPA - FreeBSD setup.
I changed my setup: instead of 2 VMs now I have 4 VMs:

1: DNS server - set up as shown by Rajnesh Kumar Siwal in 
http://www.youtube.com/watch?v=0SmiwFoHVeIindex=4list=PLdKXnZQzEG-KmtKq-LelPn5RTKfJig0Wc


2 and 3: IPA server  IPA linux client - set up as shown by Rajnesh 
Kumar

Siwal in http://www.youtube.com/watch?v=_zlcxjkbayk

4: IPA BSD client - set up as described in the post at FreeBSD forums.


Results:

1) my IPA linux client interacts fine with the IPA server;

2) my IPA BSD client also interacts with the IPA server: it sees 
IPA users
when issuing getent passwd or getent shadow. (Previously when I 
used just

2 VMs and no DNS server, that didn`t happen.)

Problems after I start sssd on the FreeBSD client:

1) I can`t ssh into my IPA BSD client either as an IPA user 
(rsiwal) or local

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-17 Thread Lukas Slebodnik

On (17/10/14 12:01), Alexander Bokovoy wrote:
Didn`t find a solution yet. But I think this is caused by lack of proper
configuration of Kerberos on my FreeBSD client. On my Linux client I found
such a configuration in /etc/krb5.conf file. However, there's no such file
on my FreeBSD client, as the post on FreeBSD forums didn't say anything
about such a file. I'll do some more checks and share the results here.
Well, follow your Kerberos library defaults. By default FreeBSD is built
with Heimdal so if your system uses Heimdal and SSSD is build against
It is true that default Kerberos library on FreeBSD is Heimdal. It is stored
in default paths (/usr/bin, /usr/lib).

SSSD does not work with Heimdal, therefore it is linked with MIT krb5 = 1.10
on FreeBSD, which is stored in (/usr/local/bin, /usr/local/lib)

LS

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

This idea is great, it would be invaluable for many people trying to 
integrate FreeBSD with FreeIPA. Currently there's only one post about 
this at FreeBSD forums, but it's not detailed and tells nothing about 
many cavets of the process.

You would have helped a lot of people to avoid frustration.

17-Oct-14 14:01, Alexander Bokovoy пишет:

See ipa-advise tool on IPA server. Currently it
only provides you with config-freebsd-nss-pam-ldapd advise to configure
FreeBSD with nss-pam-ldapd, but we can extend that to have SSSD covered
too. 


--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

Unfortunately, putting that line in /etc/pam.d/system prevents me from 
being able to locally login to the BSD client.
At the same time, the same line in /etc/pam.d/sshd or /etc/pam.d/login 
doesn't give unexpected behaviours.

Bug, bug, bug...

17-Oct-14 14:15, Lukas Slebodnik пишет:

I would reccomend to have next line in /etc/pam.d/system and /etc/pam.d/sshd.
Without this line, access control will not work. (HBAC)
account required /usr/local/lib/pam_sss.so ignore_unknown_user 
ignore_authinfo_unavail


--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-17 Thread Martin Kosek

On 10/17/2014 01:01 PM, Orkhan Gasimov wrote:
 That format is not simple for me, as I'm not a programmer. But after I check,
 double-check and triple-check my FreeBSD - FreeIPA integration via SSSD and
 assure that it works without unexpected behaviors, I'll probably write a 
 HOW-TO
 on this process and post it at FreeBSD forums.

Thanks! Would you consider also adding the HOWTO to
http://www.freeipa.org/page/HowTos
so that other people can follow your steps?

 I'll then share the link to my
 post here, so that:
 1) FreeIPA community could also check the post for any errors;
 2) someone more prepared could translate the whole process into the format
 appropriate for the ipa-advise tool.
 
 17-Oct-14 15:37, Alexander Bokovoy пишет:
 FreeIPA is an open source project where anyone can contribute in their
 areas of interest. You are welcome to contribute recipes for FreeBSD.

 The code is around
 https://git.fedorahosted.org/cgit/freeipa.git/tree/ipaserver/advise/plugins/legacy_clients.py


 As you can see, most recipes are structured in easy way and adding new
 is as simple as adding new class definition there.
 

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

Of course! But for now I'm in process of checking my integration and
there are some things I don't like.
First and foremost, any change on the IPA server is not automatically
reflected on the BSD client.
Only after SSSD is manually restarted on the client, something like
it's cache is cleared happens and new rules apply.
For now I'm not even checking something complex like sudo rule groups
with host groups, it's just a simple sudo rule for a single user.
I hope for collaboration with other interested people to find a stable
solution for FreeIPA - FreeBSD interaction via SSSD, so that as a result
of all this effort a well-detailed tutorial could be written and shared
with all *nix users.

17-Oct-14 16:17, Martin Kosek пишет:

On 10/17/2014 01:01 PM, Orkhan Gasimov wrote:

That format is not simple for me, as I'm not a programmer. But after I check,
double-check and triple-check my FreeBSD - FreeIPA integration via SSSD and
assure that it works without unexpected behaviors, I'll probably write a HOW-TO
on this process and post it at FreeBSD forums.

Thanks! Would you consider also adding the HOWTO to
http://www.freeipa.org/page/HowTos
so that other people can follow your steps?

I'll then share the link to my
post here, so that:
1) FreeIPA community could also check the post for any errors;
2) someone more prepared could translate the whole process into the format
appropriate for the ipa-advise tool.

17-Oct-14 15:37, Alexander Bokovoy пишет:

FreeIPA is an open source project where anyone can contribute in their
areas of interest. You are welcome to contribute recipes for FreeBSD.

The code is around
https://git.fedorahosted.org/cgit/freeipa.git/tree/ipaserver/advise/plugins/legacy_clients.py

As you can see, most recipes are structured in easy way and adding new
is as simple as adding new class definition there.

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-17 Thread Lukas Slebodnik

On (17/10/14 15:44), Orkhan Gasimov wrote:
Unfortunately, putting that line in /etc/pam.d/system prevents me from being
able to locally login to the BSD client.
At the same time, the same line in /etc/pam.d/sshd or /etc/pam.d/login
doesn't give unexpected behaviours.
Bug, bug, bug...

It works for me with FreeBSD 9.3. It is possible that your pam stack is
misconfigured.

Which version of FreBSD do you use?

Could you send me all files from /etc/pam.d/?

LS

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-17 Thread Martin Kosek

On 10/17/2014 01:28 PM, Orkhan Gasimov wrote:
Of course! But for now I'm in process of checking my integration and there are
some things I don't like.
First and foremost, any change on the IPA server is not automatically
reflected
on the BSD client.
Only after SSSD is manually restarted on the client, something like it's
cache
is cleared happens and new rules apply.
For now I'm not even checking something complex like sudo rule groups with
host
groups, it's just a simple sudo rule for a single user.
I hope for collaboration with other interested people to find a stable
solution
for FreeIPA - FreeBSD interaction via SSSD, so that as a result of all this
effort a well-detailed tutorial could be written and shared with all *nix
users.

+1. Or, even better approach would be if ipa-client-install script gets ported
some nice day to FreeBSD so that sssdassorted services do not need to be
configured automatically and can use autodiscover features of
ipa-client-install. But this is even farther future :-)

17-Oct-14 16:17, Martin Kosek пишет:
On 10/17/2014 01:01 PM, Orkhan Gasimov wrote:
That format is not simple for me, as I'm not a programmer. But after I
check,
double-check and triple-check my FreeBSD - FreeIPA integration via SSSD and
assure that it works without unexpected behaviors, I'll probably write a
HOW-TO
on this process and post it at FreeBSD forums.
Thanks! Would you consider also adding the HOWTO to
http://www.freeipa.org/page/HowTos
so that other people can follow your steps?

17-Oct-14 15:37, Alexander Bokovoy пишет:
FreeIPA is an open source project where anyone can contribute in their
areas of interest. You are welcome to contribute recipes for FreeBSD.

The code is around
https://git.fedorahosted.org/cgit/freeipa.git/tree/ipaserver/advise/plugins/legacy_clients.py

As you can see, most recipes are structured in easy way and adding new
is as simple as adding new class definition there.

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-17 Thread Lukas Slebodnik

On (17/10/14 16:28), Orkhan Gasimov wrote:
Of course! But for now I'm in process of checking my integration and there
are some things I don't like.
First and foremost, any change on the IPA server is not automatically
reflected on the BSD client.
sssd uses few levels of caches. If you want to have up-to-date data
you need to invalidate sssd cache (sss_cache -UG).
Details are in man sss_cache. It is not related to FreeBSD. The same behaviour
is on LInux.

If user authenticates to machine with sssd then fresh data is downloaded from
server. That's the only exception.

Only after SSSD is manually restarted on the client, something  like it's
cache is cleared happens and new rules apply.
For now I'm not even checking something complex like sudo rule groups with
host groups, it's just a simple sudo rule for a single user.
sudo is much more tricky about up-to-date data. sssd uses peridic tasks for
refreshing rules. It is not possible to invalidate sudo rules with tool
sss_cache. Detail description of sudo rules caching mechanism is in manual page
man sssd-sudo - THE SUDO RULE CACHING MECHANISM

LS

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

I found another solution (currently checked it only for adding/deleting 
a sudo rule for a user, and also enabling/disabling a user) - add to the 
[domain] section of the sssd.conf file: entry_cache_timeout = 5.



17-Oct-14 16:39, Lukas Slebodnik пишет:

sssd uses few levels of caches. If you want to have up-to-date data
you need to invalidate sssd cache (sss_cache -UG).


--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-16 Thread Orkhan Gasimov


OK, back to FreeIPA - FreeBSD setup.
I changed my setup: instead of 2 VMs now I have 4 VMs:

1: DNS server - set up as shown by Rajnesh Kumar Siwal in 
http://www.youtube.com/watch?v=0SmiwFoHVeIindex=4list=PLdKXnZQzEG-KmtKq-LelPn5RTKfJig0Wc


2 and 3: IPA server  IPA linux client - set up as shown by Rajnesh 
Kumar Siwal in http://www.youtube.com/watch?v=_zlcxjkbayk


4: IPA BSD client - set up as described in the post at FreeBSD forums.


Results:

1) my IPA linux client interacts fine with the IPA server;

2) my IPA BSD client also interacts with the IPA server: it sees IPA 
users when issuing getent passwd or getent shadow. (Previously when 
I used just 2 VMs and no DNS server, that didn`t happen.)


Problems after I start sssd on the FreeBSD client:

1) I can`t ssh into my IPA BSD client either as an IPA user (rsiwal) or 
local user (root);


2) if I restart my IPA BSD client, I also can`t login to it locally as 
either root or rsiwal. I get totally locked out of the machine.


FreeBSD displays some errors on the screen when using:

1) SSH: 
https://cloud.mail.ru/public/888b415dac43%2Fssh_error_IPA_user_and_root.JPG


2) local login: 
https://cloud.mail.ru/public/3399c5b67c33%2Flogin_error_root_and_IPA_user.JPG


FreeBSD complains about line 19 in /etc/pam.d/system. That line reads:
account  required  /usr/local/lib/pam_sss.so ignore unknown user

The file pam_sss.so exists on my FreeBSD machine in the specified 
location. Deleting ignore unknown user from that line doesn`t help. 
Changing the position of that line so that it preceeds

account  required  pam_unix.so
also gives no result.

Please help me to understand, what can I do in such a situation? Is it a 
bug in pam_sss.so?


15-Oct-14 06:14, Fraser Tweedale пишет:

On Tue, Oct 14, 2014 at 03:13:06PM +0200, Lukas Slebodnik wrote:

On (14/10/14 17:48), Fraser Tweedale wrote:

On Tue, Oct 14, 2014 at 12:34:09PM +0500, Orkhan Gasimov wrote:

With help from Alexander Bokovoy I found correct log destinations:

sssd-domain-log:
https://cloud.mail.ru/public/1e803a00989e%2Fsssd_eurosel.az.log
sssd-nss-log: https://cloud.mail.ru/public/ae41ae3b44b6%2Fsssd_nss.log

These files are from my second Fedora - FreeBSD setup, they have different
domain name, but everything else is identical.

Interestingly enough, there are lines in sssd_nss.log telling that there are
no users or groups in the domain. But as I said, I can ssh to the IPA server
as an IPA user.


Hi Orkhan,

Thanks for the logs.  What were their actual locations?

I'm going to try and reproduce your setup and see whether I get the
same outcome.  I have been building and installing the ports as
indicated in the forum post, and one thing I have noticed is that
there are a lot of configuration options on some of the important
ports - perhaps there was an important option that the author forgot
to mention.


You needn't build sssd from ports. You can install sssd with pkg utility.
The only necessary step is to build openldap client with SASL support,
because default version of openldap client is build without SASL support.
sssd cannot initialize ipa_provider with openldap libraries without SASL
support. On the other hand, {ldap,krb5,ad} providers can be used without any
problem.

The steps, how to build openldap client with SASL support, are described
in freebsd forum.


It is the end of the day for me, but sssd is now installed so I
should let you know tomorrow whether I am running into the same
issues as you, or whether I find success.

(As a side node: once I get to a working setup I will create and
publish a pkg(8) repo with the needed ports built with the correct
options and make.conf variables.  This should make it easier and
certainly quicker to use FreeBSD as a FreeIPA client.)

I am not sure what you are trying to do. Everything is described on forum.
If there isn't something clear feel free to send rephrased(updated) version of
howto. I can contact an author of that post.


Since there are non-default options and make variables to be set, is
it not desirable that there be a pkg(8) repository people can use to
install the packages needed for ipa integration?

I think it is desirable.  It is easy to thanks to
ports-mgmt/poudriere.

Fraser


LS


--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-16 Thread Lukas Slebodnik

On (16/10/14 13:04), Orkhan Gasimov wrote:
OK, back to FreeIPA - FreeBSD setup.
I changed my setup: instead of 2 VMs now I have 4 VMs:

1: DNS server - set up as shown by Rajnesh Kumar Siwal in 
http://www.youtube.com/watch?v=0SmiwFoHVeIindex=4list=PLdKXnZQzEG-KmtKq-LelPn5RTKfJig0Wc

2 and 3: IPA server  IPA linux client - set up as shown by Rajnesh Kumar
Siwal in http://www.youtube.com/watch?v=_zlcxjkbayk

4: IPA BSD client - set up as described in the post at FreeBSD forums.


Results:

1) my IPA linux client interacts fine with the IPA server;

2) my IPA BSD client also interacts with the IPA server: it sees IPA users
when issuing getent passwd or getent shadow. (Previously when I used just
2 VMs and no DNS server, that didn`t happen.)

Problems after I start sssd on the FreeBSD client:

1) I can`t ssh into my IPA BSD client either as an IPA user (rsiwal) or local
user (root);

2) if I restart my IPA BSD client, I also can`t login to it locally as either
root or rsiwal. I get totally locked out of the machine.

FreeBSD displays some errors on the screen when using:

1) SSH:
https://cloud.mail.ru/public/888b415dac43%2Fssh_error_IPA_user_and_root.JPG

2) local login:
https://cloud.mail.ru/public/3399c5b67c33%2Flogin_error_root_and_IPA_user.JPG

FreeBSD complains about line 19 in /etc/pam.d/system. That line reads:
account  required  /usr/local/lib/pam_sss.so ignore unknown user
  ^^^
  it should we one word connected with underscores _

See details in:
man pam_sss - OPTIONS

It would be good to use also argument ignore_authinfo_unavail
in pam system config otherwise you will not be able to connect as local user
if sssd will be down.

LS

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-16 Thread Orkhan Gasimov

Please excuse me for that silly typo in the letter. The typo doesn`t 
exist either in /etc/pam.d/system or /etc/pam.d/sshd - in those files I 
typed ignore_unknown_user.


I'll try ignore_authinfo_unavail to see if it prevents me from being 
locked out of the machine.


Here are the log files:

sssd_eurosel.az.log: 
https://cloud.mail.ru/public/1e803a00989e%2Fsssd_eurosel.az.log

sssd_nss.log: https://cloud.mail.ru/public/ae41ae3b44b6%2Fsssd_nss.log
sssd_pam.log: https://cloud.mail.ru/public/85d311ec1d4e%2Fsssd_pam.log
krb5_child.log: https://cloud.mail.ru/public/c0e6712b7f1b%2Fkrb5_child.log
ldap_child.log: https://cloud.mail.ru/public/d9b0b1eb0da6%2Fldap_child.log
sssd_log: https://cloud.mail.ru/public/d4032b8e6645%2Fsssd.log


16-Oct-14 14:57, Lukas Slebodnik пишет:

On (16/10/14 13:04), Orkhan Gasimov wrote:

OK, back to FreeIPA - FreeBSD setup.
I changed my setup: instead of 2 VMs now I have 4 VMs:

1: DNS server - set up as shown by Rajnesh Kumar Siwal in 
http://www.youtube.com/watch?v=0SmiwFoHVeIindex=4list=PLdKXnZQzEG-KmtKq-LelPn5RTKfJig0Wc

2 and 3: IPA server  IPA linux client - set up as shown by Rajnesh Kumar
Siwal in http://www.youtube.com/watch?v=_zlcxjkbayk

4: IPA BSD client - set up as described in the post at FreeBSD forums.


Results:

1) my IPA linux client interacts fine with the IPA server;

2) my IPA BSD client also interacts with the IPA server: it sees IPA users
when issuing getent passwd or getent shadow. (Previously when I used just
2 VMs and no DNS server, that didn`t happen.)

Problems after I start sssd on the FreeBSD client:

1) I can`t ssh into my IPA BSD client either as an IPA user (rsiwal) or local
user (root);

2) if I restart my IPA BSD client, I also can`t login to it locally as either
root or rsiwal. I get totally locked out of the machine.

FreeBSD displays some errors on the screen when using:

1) SSH:
https://cloud.mail.ru/public/888b415dac43%2Fssh_error_IPA_user_and_root.JPG

2) local login:
https://cloud.mail.ru/public/3399c5b67c33%2Flogin_error_root_and_IPA_user.JPG

FreeBSD complains about line 19 in /etc/pam.d/system. That line reads:
account  required  /usr/local/lib/pam_sss.so ignore unknown user

   ^^^
   it should we one word connected with underscores _

See details in:
 man pam_sss - OPTIONS

It would be good to use also argument ignore_authinfo_unavail
in pam system config otherwise you will not be able to connect as local user
if sssd will be down.

LS



--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-16 Thread Orkhan Gasimov


Here`s what I have at the end of the day after various checks.

SSH-ing as existing IPA user rsiwal to my FreeBSD client fails.
The same user can SSH or locally login to my Linux client.
If I create a new user in IPA, he can`t initially SSH into FreeBSD client.
BSD says: password expired, but doesn`t take new password.
The same new user can SSH into my Linux client.
Linux says: password expired and allows to set a new password with a 
message: All authentication tokens updated successfully.
After I set a new password for my newly created user via Linux, I can 
SSH into my BSD client as that user.
Using this hack I can create new users in IPA, SSH into Linux to change 
their passwords and then use those new users to SSH into FreeBSD.
At the same time I cannot locally login to my FreeBSD host as either IPA 
user or local user.


I think there`s something wrong with Kerberos setup on my FreeBSD 
client. I suspect that because both /etc/pam.d/system and 
/etc/pam.d/sshd files on the BSD client have a string:

password  sufficient  /usr/local/lib/pam_sss.so use_authtok
but BSD doesn`t let update authentication tokens when trying to change 
expired password for a new user.


There was minimal info about Kerberos setup on FreeBSD client in the 
post at FreeBSD forums. Just this: create a keytab on the IPA server 
and copy it to /etc/krb5.keytab on the FreeBSD client.


Someone here wrote that he can contact the author of that post. If so, 
please tell the author to spend a couple of hours to:

1) check everything he advised on a blank setup with VMs;
2) provide more details about correct sequence of actions.

Any help will be highly appreciated!

16-Oct-14 15:13, Orkhan Gasimov пишет:
Please excuse me for that silly typo in the letter. The typo doesn`t 
exist either in /etc/pam.d/system or /etc/pam.d/sshd - in those files 
I typed ignore_unknown_user.


I'll try ignore_authinfo_unavail to see if it prevents me from being 
locked out of the machine.


Here are the log files:

sssd_eurosel.az.log: 
https://cloud.mail.ru/public/1e803a00989e%2Fsssd_eurosel.az.log

sssd_nss.log: https://cloud.mail.ru/public/ae41ae3b44b6%2Fsssd_nss.log
sssd_pam.log: https://cloud.mail.ru/public/85d311ec1d4e%2Fsssd_pam.log
krb5_child.log: 
https://cloud.mail.ru/public/c0e6712b7f1b%2Fkrb5_child.log
ldap_child.log: 
https://cloud.mail.ru/public/d9b0b1eb0da6%2Fldap_child.log

sssd_log: https://cloud.mail.ru/public/d4032b8e6645%2Fsssd.log


16-Oct-14 14:57, Lukas Slebodnik пишет:

On (16/10/14 13:04), Orkhan Gasimov wrote:

OK, back to FreeIPA - FreeBSD setup.
I changed my setup: instead of 2 VMs now I have 4 VMs:

1: DNS server - set up as shown by Rajnesh Kumar Siwal in 
http://www.youtube.com/watch?v=0SmiwFoHVeIindex=4list=PLdKXnZQzEG-KmtKq-LelPn5RTKfJig0Wc


2 and 3: IPA server  IPA linux client - set up as shown by Rajnesh 
Kumar

Siwal in http://www.youtube.com/watch?v=_zlcxjkbayk

4: IPA BSD client - set up as described in the post at FreeBSD forums.


Results:

1) my IPA linux client interacts fine with the IPA server;

2) my IPA BSD client also interacts with the IPA server: it sees IPA 
users
when issuing getent passwd or getent shadow. (Previously when I 
used just

2 VMs and no DNS server, that didn`t happen.)

Problems after I start sssd on the FreeBSD client:

1) I can`t ssh into my IPA BSD client either as an IPA user (rsiwal) 
or local

user (root);

2) if I restart my IPA BSD client, I also can`t login to it locally 
as either

root or rsiwal. I get totally locked out of the machine.

FreeBSD displays some errors on the screen when using:

1) SSH:
https://cloud.mail.ru/public/888b415dac43%2Fssh_error_IPA_user_and_root.JPG 



2) local login:
https://cloud.mail.ru/public/3399c5b67c33%2Flogin_error_root_and_IPA_user.JPG 



FreeBSD complains about line 19 in /etc/pam.d/system. That line reads:
account  required  /usr/local/lib/pam_sss.so ignore unknown user

^^^
   it should we one word connected with 
underscores _


See details in:
 man pam_sss - OPTIONS

It would be good to use also argument ignore_authinfo_unavail
in pam system config otherwise you will not be able to connect as 
local user

if sssd will be down.

LS





--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server


On Tue, 14 Oct 2014, Orkhan Gasimov wrote:

Thanks to both of you for the interest.
Here`s the info you asked:

1. Putting debug_level = 7 either in [domain] or/and [nss] section 
of the /usr/local/etc/sssd/sssd.conf file gives nothing in the log. 
The log file located at /var/log/sssd/sssd.log is only populated with 
data when I make some errors in sssd.conf  sssd process fails to 
start. But that`s the case only if I deliberately introduce some 
errors; with current configuration sssd starts successfully.

SSSD writes separate log files per each section, so you need to look at
/var/log/sssd/sssd_mydomain.com.log for [domain/mydomain.com] and
/var/log/sssd/sssd_nss.log for nss section.

3. The users created at the IPA server can`t locally log in to the 
server, but it`s possible to ssh to the server as an IPA user from the 
FreeBSD host. However, there are some interesting behaviors (again, 
this is what happens when just following the IPA Quick Start Quide for 
the server side  the post from FreeBSD forums for the client side):

- home directories are not automatically created on the IPA server;
- id command output shows correct uid, but the group of any IPA 
user doesn`t show as ipausers - instead, the group name is the same 
as username, + something like 
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023.

In FreeIPA in Fedora we switched off ipausers being a POSIX group.
FreeIPA supports POSIX and non-POSIX groups; the latter is for grouping
purposes as groups can be nested in FreeIPA. 'ipausers' is the group
every user is a member of but it is not a POSIX group anymore so it has
less effect on performance in large deployments (tens of thousands
users in the same group).

So it is expected. The group named as a username is a user-private group
which is maintained automatically per each user. It has the same GID as
user's UID.


--
/ Alexander Bokovoy

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server


With help from Alexander Bokovoy I found correct log destinations:

sssd-domain-log: 
https://cloud.mail.ru/public/1e803a00989e%2Fsssd_eurosel.az.log

sssd-nss-log: https://cloud.mail.ru/public/ae41ae3b44b6%2Fsssd_nss.log

These files are from my second Fedora - FreeBSD setup, they have 
different domain name, but everything else is identical.


Interestingly enough, there are lines in sssd_nss.log telling that there 
are no users or groups in the domain. But as I said, I can ssh to the 
IPA server as an IPA user.


14-Oct-14 00:32, Lukas Slebodnik пишет:

On (13/10/14 20:33), Jakub Hrozek wrote:

On Mon, Oct 13, 2014 at 10:10:12PM +0400, Орхан Касумов wrote:

  Good day to everybody.
There`s a post on how to make a FreeBSD client work with a FreeIPA server:  
https://forums.freebsd.org/viewtopic.php?f=39t=46526p=260146#p260146
For some reason the instructions in that post don`t lead to a working solution.
Getent passwd/group return no data from the IPA server, although ldapsearch 
works fine.
I followed the instructions exactly (+ configured ldap.conf  started sssd) and 
didn`t get errors anywhere, all steps completed successfully.
My setup: 2 VMs, one is the FreeIPA server (on Fedora 20), the other is a 
FreeBSD client (on FreeBSD 10.0).
IPA server is configured as written in the IPA Quick Start Quide, it has no 
integrated DNS server.
Both VMs have identical /etc/hosts file:

::1localhost
127.0.0.1 localhost
192.168.1.10   ipa1.mydomain.com ipa1
192.168.1.30   bsd1.mydomain.com bsd1

Seems like some instructions in etc/nsswitch.conf file, like group: files sss and 
passwd: files sss have no effect.
Does anybody tried this setup, what could be wrong with it?
I can provide outputs of any commands if necessary.
If I shouldn`t have asked this question here, please advise me where to ask.
Any hint on what to do will be highly appreciated!

Hi,

I think SSSD logs would be the best start..

Put debug_level=7 into the [domain] section, restart SSSD and then check
out /var/log/sssd/*.log


debug_level = 7 can be put into nss section as well.
Could you share your sssd configuration file /usr/local/etc/sssd.conf?

LS



--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server


With help from Alexander Bokovoy I found correct log destinations:

sssd-domain-log:https://cloud.mail.ru/public/1e803a00989e%2Fsssd_eurosel.az.log
sssd-nss-log:https://cloud.mail.ru/public/ae41ae3b44b6%2Fsssd_nss.log

These files are from my second Fedora - FreeBSD setup, they have
different domain name, but everything else is identical.

Interestingly enough, there are lines in sssd_nss.log telling that there
are no users or groups in the domain. But as I said, I can ssh to the
IPA server as an IPA user.


14-Oct-14 10:23, Orkhan Gasimov пишет:

Thanks to both of you for the interest.
Here`s the info you asked:

1. Putting debug_level = 7 either in [domain] or/and [nss] section 
of the /usr/local/etc/sssd/sssd.conf file gives nothing in the log. 
The log file located at /var/log/sssd/sssd.log is only populated with 
data when I make some errors in sssd.conf  sssd process fails to 
start. But that`s the case only if I deliberately introduce some 
errors; with current configuration sssd starts successfully.


2. My original sssd.conf (without debugs) is as follows (exact copy of 
what was shown in the post at FreeBSD forums):


-
[domain/mydomain.com]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = mydomain.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = ipa1.mydomain.com
chpass_provider = ipa
ipa_server = _srv_ #our FreeIPA server has DNS SRV entries
ldap_tls_cacert = /etc/ssl/ca.crt
enumerate = True #to enumerate users and groups

[sssd]
enumerate = True
services = nss, pam, sudo
config_file_version = 2
domains = mydomain.com

[nss]

[pam]

[sudo]
-

Interestingly enough the [nss] section is empty, just as shown in the 
post at FreeBSD forums.


3. The users created at the IPA server can`t locally log in to the 
server, but it`s possible to ssh to the server as an IPA user from the 
FreeBSD host. However, there are some interesting behaviors (again, 
this is what happens when just following the IPA Quick Start Quide for 
the server side  the post from FreeBSD forums for the client side):

 - home directories are not automatically created on the IPA server;
 - id command output shows correct uid, but the group of any IPA 
user doesn`t show as ipausers - instead, the group name is the same 
as username, + something like 
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023.


4. Here is the list of snapshots taken from my FreeBSD VM when I 
installed necessary ports, maybe these snapshots will provide some 
additional info on sssd behavior:


clean_install
starting_sssd_install
krb5_choice_added_LDAP
openldap24-sasl-client_choice_added_FETCH_GSSAPI
cyrus-sasl2_choice_defaults
bind_choice_added_GSSAPI_MIT
sssd_installation_finished
sudo_installed_with_INSULTS_LDAP_SSSD
cyrus-sasl2-gssapi_choice_added_MIT
all_ports_installed_directories_created
all_configs_applied_sssd_started


14-Oct-14 00:32, Lukas Slebodnik пишет:

On (13/10/14 20:33), Jakub Hrozek wrote:

On Mon, Oct 13, 2014 at 10:10:12PM +0400, Орхан Касумов wrote:

  Good day to everybody.
There`s a post on how to make a FreeBSD client work with a FreeIPA 
server: 
https://forums.freebsd.org/viewtopic.php?f=39t=46526p=260146#p260146
For some reason the instructions in that post don`t lead to a 
working solution.
Getent passwd/group return no data from the IPA server, although 
ldapsearch works fine.
I followed the instructions exactly (+ configured ldap.conf  
started sssd) and didn`t get errors anywhere, all steps completed 
successfully.
My setup: 2 VMs, one is the FreeIPA server (on Fedora 20), the 
other is a FreeBSD client (on FreeBSD 10.0).
IPA server is configured as written in the IPA Quick Start Quide, 
it has no integrated DNS server.

Both VMs have identical /etc/hosts file:

::1localhost
127.0.0.1 localhost
192.168.1.10   ipa1.mydomain.com ipa1
192.168.1.30   bsd1.mydomain.com bsd1

Seems like some instructions in etc/nsswitch.conf file, like 
group: files sss and passwd: files sss have no effect.

Does anybody tried this setup, what could be wrong with it?
I can provide outputs of any commands if necessary.
If I shouldn`t have asked this question here, please advise me 
where to ask.

Any hint on what to do will be highly appreciated!

Hi,

I think SSSD logs would be the best start..

Put debug_level=7 into the [domain] section, restart SSSD and then 
check

out /var/log/sssd/*.log


debug_level = 7 can be put into nss section as well.
Could you share your sssd configuration file /usr/local/etc/sssd.conf?

LS





-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-14 Thread Fraser Tweedale

On Tue, Oct 14, 2014 at 12:34:09PM +0500, Orkhan Gasimov wrote:
 With help from Alexander Bokovoy I found correct log destinations:
 
 sssd-domain-log:
 https://cloud.mail.ru/public/1e803a00989e%2Fsssd_eurosel.az.log
 sssd-nss-log: https://cloud.mail.ru/public/ae41ae3b44b6%2Fsssd_nss.log
 
 These files are from my second Fedora - FreeBSD setup, they have different
 domain name, but everything else is identical.
 
 Interestingly enough, there are lines in sssd_nss.log telling that there are
 no users or groups in the domain. But as I said, I can ssh to the IPA server
 as an IPA user.
 
Hi Orkhan,

Thanks for the logs.  What were their actual locations?

I'm going to try and reproduce your setup and see whether I get the
same outcome.  I have been building and installing the ports as
indicated in the forum post, and one thing I have noticed is that
there are a lot of configuration options on some of the important
ports - perhaps there was an important option that the author forgot
to mention.

It is the end of the day for me, but sssd is now installed so I
should let you know tomorrow whether I am running into the same
issues as you, or whether I find success.

(As a side node: once I get to a working setup I will create and
publish a pkg(8) repo with the needed ports built with the correct
options and make.conf variables.  This should make it easier and
certainly quicker to use FreeBSD as a FreeIPA client.)

Cheers,

Fraser

 14-Oct-14 00:32, Lukas Slebodnik пишет:
 On (13/10/14 20:33), Jakub Hrozek wrote:
 On Mon, Oct 13, 2014 at 10:10:12PM +0400, Орхан Касумов wrote:
   Good day to everybody.
 There`s a post on how to make a FreeBSD client work with a FreeIPA server: 
  https://forums.freebsd.org/viewtopic.php?f=39t=46526p=260146#p260146
 For some reason the instructions in that post don`t lead to a working 
 solution.
 Getent passwd/group return no data from the IPA server, although 
 ldapsearch works fine.
 I followed the instructions exactly (+ configured ldap.conf  started 
 sssd) and didn`t get errors anywhere, all steps completed successfully.
 My setup: 2 VMs, one is the FreeIPA server (on Fedora 20), the other is a 
 FreeBSD client (on FreeBSD 10.0).
 IPA server is configured as written in the IPA Quick Start Quide, it has 
 no integrated DNS server.
 Both VMs have identical /etc/hosts file:
 
 ::1localhost
 127.0.0.1 localhost
 192.168.1.10   ipa1.mydomain.com ipa1
 192.168.1.30   bsd1.mydomain.com bsd1
 
 Seems like some instructions in etc/nsswitch.conf file, like group: files 
 sss and passwd: files sss have no effect.
 Does anybody tried this setup, what could be wrong with it?
 I can provide outputs of any commands if necessary.
 If I shouldn`t have asked this question here, please advise me where to 
 ask.
 Any hint on what to do will be highly appreciated!
 Hi,
 
 I think SSSD logs would be the best start..
 
 Put debug_level=7 into the [domain] section, restart SSSD and then check
 out /var/log/sssd/*.log
 
 debug_level = 7 can be put into nss section as well.
 Could you share your sssd configuration file /usr/local/etc/sssd.conf?
 
 LS
 
 
 -- 
 Manage your subscription for the Freeipa-users mailing list:
 https://www.redhat.com/mailman/listinfo/freeipa-users
 Go To http://freeipa.org for more info on the project

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server


On Tue, 14 Oct 2014, Orkhan Gasimov wrote:

With help from Alexander Bokovoy I found correct log destinations:

sssd-domain-log:https://cloud.mail.ru/public/1e803a00989e%2Fsssd_eurosel.az.log
sssd-nss-log:https://cloud.mail.ru/public/ae41ae3b44b6%2Fsssd_nss.log

These files are from my second Fedora - FreeBSD setup, they have
different domain name, but everything else is identical.

Interestingly enough, there are lines in sssd_nss.log telling that there
are no users or groups in the domain. But as I said, I can ssh to the
IPA server as an IPA user.

You have basic problem of DNS resolution at the FreeBSD client side:
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]]
[request_watch_destructor] (0x0400): Deleting request watch
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]] [resolve_srv_done]
(0x0020): SRV query failed: [Domain name not found]
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]] [fo_set_port_status]
(0x0100): Marking port 0 of server '(no name)' as 'not working'
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]] [set_srv_data_status]
(0x0100): Marking SRV lookup of service 'IPA' as 'not resolved'
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]]
[be_resolve_server_process] (0x0080): Couldn't resolve server (SRV
lookup meta-server), resolver returned (5)
...
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]] [fo_set_port_status]
(0x0100): Marking port 0 of server '(no name)' as 'not working'
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]] [set_srv_data_status]
(0x0100): Marking SRV lookup of service 'IPA' as 'not resolved'
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]]
[be_resolve_server_process] (0x0080): Couldn't resolve server (SRV
lookup meta-server), resolver returned (5)
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]]
[be_resolve_server_process] (0x1000): Trying with the next one!
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]]
[fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA'
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]] [get_port_status]
(0x1000): Port status of port 0 for server '(no name)' is 'not working'
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]]
[fo_resolve_service_send] (0x0020): No available servers for service
'IPA'
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]]
[be_resolve_server_done] (0x1000): Server resolution failed: 5
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]]
[sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5
[Input/output error])
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]] [be_run_offline_cb]
(0x0080): Going offline. Running callbacks.


Make sure your DNS infrastructure is actually working. Run following on
FreeBSD side:

dig SRV _ldap._tcp.eurosel.az
dig SRV _kerberos._tcp.eurosel.az

and fix either your resolver or DNS server to properly resolve SRV
records for IPA domain (assuming eurosel.az is your IPA domain).

--
/ Alexander Bokovoy

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server


Thanks for taking time to find a solution.

1. Location of log files is /var/log/sssd , I just didn`t know that each 
section of sssd.conf file produced its own log file:


/var/log/sssd/sssd_your.domain.log
/var/log/sssd/sssd_nss.log

2. For the client side, here again the list of snapshots taken from my 
FreeBSD VM when I installed necessary ports, maybe these snapshots will 
provide some additional info on sssd behavior:


clean_install
starting_sssd_install
krb5_choice_added_LDAP
openldap24-sasl-client_choice_added_FETCH_GSSAPI
cyrus-sasl2_choice_defaults
bind_choice_added_GSSAPI_MIT
sssd_installation_finished
sudo_installed_with_INSULTS_LDAP_SSSD
cyrus-sasl2-gssapi_choice_added_MIT
all_ports_installed_directories_created
all_configs_applied_sssd_started

3. For the server side, one thing that I had to do differently when 
adding the client to the server, is I used the --force option, as the 
server complained about the host not having a DNS A record (I don`t run 
DNS server on IPA server).


14-Oct-14 12:48, Fraser Tweedale пишет:

On Tue, Oct 14, 2014 at 12:34:09PM +0500, Orkhan Gasimov wrote:

With help from Alexander Bokovoy I found correct log destinations:

sssd-domain-log:
https://cloud.mail.ru/public/1e803a00989e%2Fsssd_eurosel.az.log
sssd-nss-log: https://cloud.mail.ru/public/ae41ae3b44b6%2Fsssd_nss.log

These files are from my second Fedora - FreeBSD setup, they have different
domain name, but everything else is identical.

Interestingly enough, there are lines in sssd_nss.log telling that there are
no users or groups in the domain. But as I said, I can ssh to the IPA server
as an IPA user.


Hi Orkhan,

Thanks for the logs.  What were their actual locations?

I'm going to try and reproduce your setup and see whether I get the
same outcome.  I have been building and installing the ports as
indicated in the forum post, and one thing I have noticed is that
there are a lot of configuration options on some of the important
ports - perhaps there was an important option that the author forgot
to mention.

It is the end of the day for me, but sssd is now installed so I
should let you know tomorrow whether I am running into the same
issues as you, or whether I find success.

(As a side node: once I get to a working setup I will create and
publish a pkg(8) repo with the needed ports built with the correct
options and make.conf variables.  This should make it easier and
certainly quicker to use FreeBSD as a FreeIPA client.)

Cheers,

Fraser


14-Oct-14 00:32, Lukas Slebodnik пишет:

On (13/10/14 20:33), Jakub Hrozek wrote:

On Mon, Oct 13, 2014 at 10:10:12PM +0400, Орхан Касумов wrote:

  Good day to everybody.
There`s a post on how to make a FreeBSD client work with a FreeIPA server:  
https://forums.freebsd.org/viewtopic.php?f=39t=46526p=260146#p260146
For some reason the instructions in that post don`t lead to a working solution.
Getent passwd/group return no data from the IPA server, although ldapsearch 
works fine.
I followed the instructions exactly (+ configured ldap.conf  started sssd) and 
didn`t get errors anywhere, all steps completed successfully.
My setup: 2 VMs, one is the FreeIPA server (on Fedora 20), the other is a 
FreeBSD client (on FreeBSD 10.0).
IPA server is configured as written in the IPA Quick Start Quide, it has no 
integrated DNS server.
Both VMs have identical /etc/hosts file:

::1localhost
127.0.0.1 localhost
192.168.1.10   ipa1.mydomain.com ipa1
192.168.1.30   bsd1.mydomain.com bsd1

Seems like some instructions in etc/nsswitch.conf file, like group: files sss and 
passwd: files sss have no effect.
Does anybody tried this setup, what could be wrong with it?
I can provide outputs of any commands if necessary.
If I shouldn`t have asked this question here, please advise me where to ask.
Any hint on what to do will be highly appreciated!

Hi,

I think SSSD logs would be the best start..

Put debug_level=7 into the [domain] section, restart SSSD and then check
out /var/log/sssd/*.log


debug_level = 7 can be put into nss section as well.
Could you share your sssd configuration file /usr/local/etc/sssd.conf?

LS


--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project


--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-14 Thread Lukas Slebodnik

On (14/10/14 10:23), Orkhan Gasimov wrote:
Thanks to both of you for the interest.
Here`s the info you asked:

1. Putting debug_level = 7 either in [domain] or/and [nss] section of the
/usr/local/etc/sssd/sssd.conf file gives nothing in the log. The log file
located at /var/log/sssd/sssd.log is only populated with data when I make
some errors in sssd.conf  sssd process fails to start. But that`s the case
only if I deliberately introduce some errors; with current configuration sssd
starts successfully.

2. My original sssd.conf (without debugs) is as follows (exact copy of what
was shown in the post at FreeBSD forums):

-
[domain/mydomain.com]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = mydomain.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = ipa1.mydomain.com
chpass_provider = ipa
ipa_server = _srv_ #our FreeIPA server has DNS SRV entries


[resolv_getsrv_send] (0x0100): Trying to resolve SRV record of 
'_ldap._tcp.eurosel.az'
...
[resolve_srv_done] (0x0020): SRV query failed: [Domain name not found]
[set_srv_data_status] (0x0100): Marking SRV lookup of service 'IPA' as 'not 
resolved'
[be_resolve_server_process] (0x0080): Couldn't resolve server (SRV lookup 
meta-server), resolver returned (5)

DNS discovery of IPA server failed, becuase you just configured few hostnames
in /etc/hosts

You can add IP address or hostname to the option ipa_server
e.g.
ipa_server = _srv_, vm-120.eurosel.az

BTW In my opinion, it is better to have comment before the optiona and not on
the same line :-)

LS

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server


I suspected that problems could arise with DNS, and here they are...

In fact, this entire string: ipa_server = _srv_ #our FreeIPA server has 
DNS SRV entries was taken as-is from the how-to on FreeBSD forums. 
First I commented it out, because was unsure sure if it was appropriate 
for my simple setup with just 2 VMs and and a bunch of records in 
/etc/hosts file. After starting sssd, I could get no IPA data 
withgetent passwd or getent group commands. They I uncommented it 
and restarted sssd, but things remained the same.


Now your advice is:  ...add IP address or hostname to the option 
ipa_server, but you use an arbitrary name like vm-120.eurosel.az. 
Could you please explain which host`s FQDN I should put there? If I use 
ipa1.eurosel.az, then sssd won`t start (complains about ...Looping 
detected inside krb5_get_in_tkt...).


If it MUST be a DNS server, then everything changes. And the question 
then becomes: is it possible to set up a test FreeIPA client-server 
interaction using only 2 VMs and proper records in /etc/hosts instead of 
a DNS server? Or one MUST add a third VM and make it a DNS server to 
facilitate client-server interaction?


14-Oct-14 12:58, Lukas Slebodnik пишет:

On (14/10/14 10:23), Orkhan Gasimov wrote:

Thanks to both of you for the interest.
Here`s the info you asked:

1. Putting debug_level = 7 either in [domain] or/and [nss] section of the
/usr/local/etc/sssd/sssd.conf file gives nothing in the log. The log file
located at /var/log/sssd/sssd.log is only populated with data when I make
some errors in sssd.conf  sssd process fails to start. But that`s the case
only if I deliberately introduce some errors; with current configuration sssd
starts successfully.

2. My original sssd.conf (without debugs) is as follows (exact copy of what
was shown in the post at FreeBSD forums):

-
[domain/mydomain.com]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = mydomain.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = ipa1.mydomain.com
chpass_provider = ipa
ipa_server = _srv_ #our FreeIPA server has DNS SRV entries


[resolv_getsrv_send] (0x0100): Trying to resolve SRV record of 
'_ldap._tcp.eurosel.az'
...
[resolve_srv_done] (0x0020): SRV query failed: [Domain name not found]
[set_srv_data_status] (0x0100): Marking SRV lookup of service 'IPA' as 'not 
resolved'
[be_resolve_server_process] (0x0080): Couldn't resolve server (SRV lookup 
meta-server), resolver returned (5)

DNS discovery of IPA server failed, becuase you just configured few hostnames
in /etc/hosts

You can add IP address or hostname to the option ipa_server
e.g.
 ipa_server = _srv_, vm-120.eurosel.az

BTW In my opinion, it is better to have comment before the optiona and not on
the same line :-)

LS


--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

I tried to avoid setting up a third VM to serve as a DNS server for my 
test scenario. Thought it would be possible to set up working FreeIPA 
client-server interaction with just 2 VMs  correct hostnames  
/etc/hosts files in them.


Do I correctly understand your idea that it`s a MUST to set up a DNS 
server to facilitate FreeIPA client-server interaction? Or there`s a way 
to do it with just 2 VMs and no DNS server?



14-Oct-14 12:50, Alexander Bokovoy пишет:

On Tue, 14 Oct 2014, Orkhan Gasimov wrote:

With help from Alexander Bokovoy I found correct log destinations:

sssd-domain-log:https://cloud.mail.ru/public/1e803a00989e%2Fsssd_eurosel.az.log 


sssd-nss-log:https://cloud.mail.ru/public/ae41ae3b44b6%2Fsssd_nss.log

These files are from my second Fedora - FreeBSD setup, they have
different domain name, but everything else is identical.

Interestingly enough, there are lines in sssd_nss.log telling that there
are no users or groups in the domain. But as I said, I can ssh to the
IPA server as an IPA user.

You have basic problem of DNS resolution at the FreeBSD client side:
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]]
[request_watch_destructor] (0x0400): Deleting request watch
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]] [resolve_srv_done]
(0x0020): SRV query failed: [Domain name not found]
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]] [fo_set_port_status]
(0x0100): Marking port 0 of server '(no name)' as 'not working'
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]] [set_srv_data_status]
(0x0100): Marking SRV lookup of service 'IPA' as 'not resolved'
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]]
[be_resolve_server_process] (0x0080): Couldn't resolve server (SRV
lookup meta-server), resolver returned (5)
...
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]] [fo_set_port_status]
(0x0100): Marking port 0 of server '(no name)' as 'not working'
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]] [set_srv_data_status]
(0x0100): Marking SRV lookup of service 'IPA' as 'not resolved'
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]]
[be_resolve_server_process] (0x0080): Couldn't resolve server (SRV
lookup meta-server), resolver returned (5)
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]]
[be_resolve_server_process] (0x1000): Trying with the next one!
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]]
[fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA'
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]] [get_port_status]
(0x1000): Port status of port 0 for server '(no name)' is 'not working'
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]]
[fo_resolve_service_send] (0x0020): No available servers for service
'IPA'
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]]
[be_resolve_server_done] (0x1000): Server resolution failed: 5
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]]
[sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5
[Input/output error])
(Tue Oct 14 12:09:04 2014) [sssd[be[eurosel.az]]] [be_run_offline_cb]
(0x0080): Going offline. Running callbacks.


Make sure your DNS infrastructure is actually working. Run following on
FreeBSD side:

dig SRV _ldap._tcp.eurosel.az
dig SRV _kerberos._tcp.eurosel.az

and fix either your resolver or DNS server to properly resolve SRV
records for IPA domain (assuming eurosel.az is your IPA domain).



--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server


On 14.10.2014 11:49, Orkhan Gasimov wrote:

I suspected that problems could arise with DNS, and here they are...

In fact, this entire string: ipa_server = _srv_ #our FreeIPA server has DNS
SRV entries was taken as-is from the how-to on FreeBSD forums. First I
commented it out, because was unsure sure if it was appropriate for my simple
setup with just 2 VMs and and a bunch of records in /etc/hosts file. After
starting sssd, I could get no IPA data withgetent passwd or getent group
commands. They I uncommented it and restarted sssd, but things remained the 
same.

Now your advice is:  ...add IP address or hostname to the option ipa_server,
but you use an arbitrary name like vm-120.eurosel.az. Could you please
explain which host`s FQDN I should put there? If I use ipa1.eurosel.az, then
sssd won`t start (complains about ...Looping detected inside
krb5_get_in_tkt...).

If it MUST be a DNS server, then everything changes. And the question then
becomes: is it possible to set up a test FreeIPA client-server interaction
using only 2 VMs and proper records in /etc/hosts instead of a DNS server? Or
one MUST add a third VM and make it a DNS server to facilitate client-server
interaction?


IPA theoretically can work without DNS records but it requires very careful 
configuration on clients and is strongly discouraged.


If you want to do quick  dirty test, do this:
$ ipa-server-install --setup-dns --forwarder ip address of your *existing* 
DNS server
+ specify IPA domain name which is sub-domain of you existing domain (e.g. 
ipa.eurosel.az)

+ change /etc/resolv.conf on *all* clients to point to IPA server

*This is a dirty trick* and it will not work unless all your clients has the 
IPA server in resolv.conf. It will most likely break when you try to use AD 
trust with AD clients etc.



*In production environment* you should add NS records for ipa.eurosel.az 
domain to the parent DNS zone to create proper delegation. In that case you 
don't need to fiddle with resolv.conf on all clients.


Let me know if you need further assistance.

Petr^2 Spacek



14-Oct-14 12:58, Lukas Slebodnik пишет:

On (14/10/14 10:23), Orkhan Gasimov wrote:

Thanks to both of you for the interest.
Here`s the info you asked:

1. Putting debug_level = 7 either in [domain] or/and [nss] section of the
/usr/local/etc/sssd/sssd.conf file gives nothing in the log. The log file
located at /var/log/sssd/sssd.log is only populated with data when I make
some errors in sssd.conf  sssd process fails to start. But that`s the case
only if I deliberately introduce some errors; with current configuration sssd
starts successfully.

2. My original sssd.conf (without debugs) is as follows (exact copy of what
was shown in the post at FreeBSD forums):

-
[domain/mydomain.com]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = mydomain.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = ipa1.mydomain.com
chpass_provider = ipa
ipa_server = _srv_ #our FreeIPA server has DNS SRV entries


[resolv_getsrv_send] (0x0100): Trying to resolve SRV record of
'_ldap._tcp.eurosel.az'
...
[resolve_srv_done] (0x0020): SRV query failed: [Domain name not found]
[set_srv_data_status] (0x0100): Marking SRV lookup of service 'IPA' as 'not
resolved'
[be_resolve_server_process] (0x0080): Couldn't resolve server (SRV lookup
meta-server), resolver returned (5)

DNS discovery of IPA server failed, becuase you just configured few hostnames
in /etc/hosts

You can add IP address or hostname to the option ipa_server
e.g.
 ipa_server = _srv_, vm-120.eurosel.az

BTW In my opinion, it is better to have comment before the optiona and not on
the same line :-)


--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server


On Tue, 14 Oct 2014, Orkhan Gasimov wrote:
I tried to avoid setting up a third VM to serve as a DNS server for my 
test scenario. Thought it would be possible to set up working FreeIPA 
client-server interaction with just 2 VMs  correct hostnames  
/etc/hosts files in them.

Many applications rely on service discovery based on DNS. In particular,
SSSD uses this approach if you don't set explicitly servers for LDAP,
Kerberos, IPA, etc. See sssd-ldap(5), sssd-krb5(5), sssd-ipa(5), section
'SERVICE DISCOVERY'.

The mechanism is described in RFC 2782. It becomes even more important
for cases like integration with Active Directory where AD side relies on
DNS service discovery unconditionally.

IPA has integrated DNS server, all you needed to do is to run
'ipa-server-install --setup-dns' or 'ipa-dns-install' afterwards.

If you don't want to use IPA-provided DNS server, at the end of
ipa-server-install a sample DNS zone was generated to show what records
need to be added to your DNS zone.


Do I correctly understand your idea that it`s a MUST to set up a DNS 
server to facilitate FreeIPA client-server interaction? Or there`s a 
way to do it with just 2 VMs and no DNS server?

Use integrated DNS server in FreeIPA server, this is supported way of
doing it. FreeIPA then will make it manageable through its tools -- be
it command line interface or web UI.


--
/ Alexander Bokovoy

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server


I`ll try such a test setup, then share information about results.

14-Oct-14 15:04, Petr Spacek пишет:

On 14.10.2014 11:49, Orkhan Gasimov wrote:

I suspected that problems could arise with DNS, and here they are...

In fact, this entire string: ipa_server = _srv_ #our FreeIPA server 
has DNS

SRV entries was taken as-is from the how-to on FreeBSD forums. First I
commented it out, because was unsure sure if it was appropriate for 
my simple
setup with just 2 VMs and and a bunch of records in /etc/hosts file. 
After
starting sssd, I could get no IPA data withgetent passwd or getent 
group
commands. They I uncommented it and restarted sssd, but things 
remained the same.


Now your advice is:  ...add IP address or hostname to the option 
ipa_server,

but you use an arbitrary name like vm-120.eurosel.az. Could you please
explain which host`s FQDN I should put there? If I use 
ipa1.eurosel.az, then

sssd won`t start (complains about ...Looping detected inside
krb5_get_in_tkt...).

If it MUST be a DNS server, then everything changes. And the question 
then
becomes: is it possible to set up a test FreeIPA client-server 
interaction
using only 2 VMs and proper records in /etc/hosts instead of a DNS 
server? Or
one MUST add a third VM and make it a DNS server to facilitate 
client-server

interaction?


IPA theoretically can work without DNS records but it requires very 
careful configuration on clients and is strongly discouraged.


If you want to do quick  dirty test, do this:
$ ipa-server-install --setup-dns --forwarder ip address of your 
*existing* DNS server
+ specify IPA domain name which is sub-domain of you existing domain 
(e.g. ipa.eurosel.az)

+ change /etc/resolv.conf on *all* clients to point to IPA server

*This is a dirty trick* and it will not work unless all your clients 
has the IPA server in resolv.conf. It will most likely break when you 
try to use AD trust with AD clients etc.



*In production environment* you should add NS records for 
ipa.eurosel.az domain to the parent DNS zone to create proper 
delegation. In that case you don't need to fiddle with resolv.conf on 
all clients.


Let me know if you need further assistance.

Petr^2 Spacek



14-Oct-14 12:58, Lukas Slebodnik пишет:

On (14/10/14 10:23), Orkhan Gasimov wrote:

Thanks to both of you for the interest.
Here`s the info you asked:

1. Putting debug_level = 7 either in [domain] or/and [nss] 
section of the
/usr/local/etc/sssd/sssd.conf file gives nothing in the log. The 
log file
located at /var/log/sssd/sssd.log is only populated with data when 
I make
some errors in sssd.conf  sssd process fails to start. But that`s 
the case
only if I deliberately introduce some errors; with current 
configuration sssd

starts successfully.

2. My original sssd.conf (without debugs) is as follows (exact copy 
of what

was shown in the post at FreeBSD forums):

-
[domain/mydomain.com]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = mydomain.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = ipa1.mydomain.com
chpass_provider = ipa
ipa_server = _srv_ #our FreeIPA server has DNS SRV entries


[resolv_getsrv_send] (0x0100): Trying to resolve SRV record of
'_ldap._tcp.eurosel.az'
...
[resolve_srv_done] (0x0020): SRV query failed: [Domain name not found]
[set_srv_data_status] (0x0100): Marking SRV lookup of service 'IPA' 
as 'not

resolved'
[be_resolve_server_process] (0x0080): Couldn't resolve server (SRV 
lookup

meta-server), resolver returned (5)

DNS discovery of IPA server failed, becuase you just configured few 
hostnames

in /etc/hosts

You can add IP address or hostname to the option ipa_server
e.g.
 ipa_server = _srv_, vm-120.eurosel.az

BTW In my opinion, it is better to have comment before the optiona 
and not on

the same line :-)




--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server


On 14.10.2014 11:49, Orkhan Gasimov wrote:

I suspected that problems could arise with DNS, and here they are...

In fact, this entire string: ipa_server = _srv_ #our FreeIPA server has DNS
SRV entries was taken as-is from the how-to on FreeBSD forums. First I
commented it out, because was unsure sure if it was appropriate for my simple
setup with just 2 VMs and and a bunch of records in /etc/hosts file. After
starting sssd, I could get no IPA data withgetent passwd or getent group
commands. They I uncommented it and restarted sssd, but things remained the 
same.

Now your advice is:  ...add IP address or hostname to the option ipa_server,
but you use an arbitrary name like vm-120.eurosel.az. Could you please
explain which host`s FQDN I should put there? If I use ipa1.eurosel.az, then
sssd won`t start (complains about ...Looping detected inside
krb5_get_in_tkt...).

If it MUST be a DNS server, then everything changes. And the question then
becomes: is it possible to set up a test FreeIPA client-server interaction
using only 2 VMs and proper records in /etc/hosts instead of a DNS server? Or
one MUST add a third VM and make it a DNS server to facilitate client-server
interaction?


IPA theoretically can work without DNS records but it requires very careful 
configuration on clients and is strongly discouraged.


If you want to do quick  dirty test, do this:
$ ipa-server-install --setup-dns --forwarder ip address of your *existing* 
DNS server
+ specify IPA domain name which is sub-domain of you existing domain (e.g. 
ipa.eurosel.az)

+ change /etc/resolv.conf on *all* clients to point to IPA server

*This is a dirty trick* and it will not work unless all your clients has the 
IPA server in resolv.conf. It will most likely break when you try to use AD 
trust with AD clients etc.



*In production environment* you should add NS records for ipa.eurosel.az 
domain to the parent DNS zone to create proper delegation. In that case you 
don't need to fiddle with resolv.conf on all clients.


Let me know if you need further assistance.

Petr^2 Spacek



14-Oct-14 12:58, Lukas Slebodnik пишет:

On (14/10/14 10:23), Orkhan Gasimov wrote:

Thanks to both of you for the interest.
Here`s the info you asked:

1. Putting debug_level = 7 either in [domain] or/and [nss] section of the
/usr/local/etc/sssd/sssd.conf file gives nothing in the log. The log file
located at /var/log/sssd/sssd.log is only populated with data when I make
some errors in sssd.conf  sssd process fails to start. But that`s the case
only if I deliberately introduce some errors; with current configuration sssd
starts successfully.

2. My original sssd.conf (without debugs) is as follows (exact copy of what
was shown in the post at FreeBSD forums):

-
[domain/mydomain.com]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = mydomain.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = ipa1.mydomain.com
chpass_provider = ipa
ipa_server = _srv_ #our FreeIPA server has DNS SRV entries


[resolv_getsrv_send] (0x0100): Trying to resolve SRV record of
'_ldap._tcp.eurosel.az'
...
[resolve_srv_done] (0x0020): SRV query failed: [Domain name not found]
[set_srv_data_status] (0x0100): Marking SRV lookup of service 'IPA' as 'not
resolved'
[be_resolve_server_process] (0x0080): Couldn't resolve server (SRV lookup
meta-server), resolver returned (5)

DNS discovery of IPA server failed, becuase you just configured few hostnames
in /etc/hosts

You can add IP address or hostname to the option ipa_server
e.g.
 ipa_server = _srv_, vm-120.eurosel.az

BTW In my opinion, it is better to have comment before the optiona and not on
the same line :-)


--
Petr^2 Spacek

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server


I need further assistance with this moment:
specify IPA domain name which is sub-domain of you existing domain 
(e.g. ipa.eurosel.az) .


Currently my FreeIPA server's hostname is ipa1.eurosel.az, and client's 
hostname is bsd1.eurosel.az.

So when running this command:

ipa-server-install --setup-dns --forwarder ip address of your 
*existing* DNS server,


the installation program detects the hostname of the VM 
(ipa1.eurosel.az) and offers it as IPA server FQDN;
then it offers eurosel.az as the domain name. I can make changes right 
during the installation process (FQDN = ipa1.ipa.eurosel.az  domain = 
ipa.eurosel.az), but then there will be a conflict with the real 
hostname and records in the /etc/hosts file.


On the other hand, if I change the hostname of the server VM to 
ipa1.ipa.eurosel.az prior to running the IPA installation program, 
then the installation program will offer my server an FQDN of 
ipa1.ipa.eurosel.az and a domain name of ipa.eurosel.az. But doesn`t 
it mean that my client`s hostname should also be changed to 
bsd1.ipa.eurosel.az? I`d like to avoid this, because in production I 
won`t be able to change the domain part of FQDN for hundreds of clients.


Please don`t hesitate to explain a little clearer.

14-Oct-14 16:29, Petr Spacek пишет:

On 14.10.2014 11:49, Orkhan Gasimov wrote:

I suspected that problems could arise with DNS, and here they are...

In fact, this entire string: ipa_server = _srv_ #our FreeIPA server 
has DNS

SRV entries was taken as-is from the how-to on FreeBSD forums. First I
commented it out, because was unsure sure if it was appropriate for 
my simple
setup with just 2 VMs and and a bunch of records in /etc/hosts file. 
After
starting sssd, I could get no IPA data withgetent passwd or getent 
group
commands. They I uncommented it and restarted sssd, but things 
remained the same.


Now your advice is:  ...add IP address or hostname to the option 
ipa_server,

but you use an arbitrary name like vm-120.eurosel.az. Could you please
explain which host`s FQDN I should put there? If I use 
ipa1.eurosel.az, then

sssd won`t start (complains about ...Looping detected inside
krb5_get_in_tkt...).

If it MUST be a DNS server, then everything changes. And the question 
then
becomes: is it possible to set up a test FreeIPA client-server 
interaction
using only 2 VMs and proper records in /etc/hosts instead of a DNS 
server? Or
one MUST add a third VM and make it a DNS server to facilitate 
client-server

interaction?


IPA theoretically can work without DNS records but it requires very 
careful configuration on clients and is strongly discouraged.


If you want to do quick  dirty test, do this:
$ ipa-server-install --setup-dns --forwarder ip address of your 
*existing* DNS server
+ specify IPA domain name which is sub-domain of you existing domain 
(e.g. ipa.eurosel.az)

+ change /etc/resolv.conf on *all* clients to point to IPA server

*This is a dirty trick* and it will not work unless all your clients 
has the IPA server in resolv.conf. It will most likely break when you 
try to use AD trust with AD clients etc.



*In production environment* you should add NS records for 
ipa.eurosel.az domain to the parent DNS zone to create proper 
delegation. In that case you don't need to fiddle with resolv.conf on 
all clients.


Let me know if you need further assistance.

Petr^2 Spacek



14-Oct-14 12:58, Lukas Slebodnik пишет:

On (14/10/14 10:23), Orkhan Gasimov wrote:

Thanks to both of you for the interest.
Here`s the info you asked:

1. Putting debug_level = 7 either in [domain] or/and [nss] 
section of the
/usr/local/etc/sssd/sssd.conf file gives nothing in the log. The 
log file
located at /var/log/sssd/sssd.log is only populated with data when 
I make
some errors in sssd.conf  sssd process fails to start. But that`s 
the case
only if I deliberately introduce some errors; with current 
configuration sssd

starts successfully.

2. My original sssd.conf (without debugs) is as follows (exact copy 
of what

was shown in the post at FreeBSD forums):

-
[domain/mydomain.com]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = mydomain.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = ipa1.mydomain.com
chpass_provider = ipa
ipa_server = _srv_ #our FreeIPA server has DNS SRV entries


[resolv_getsrv_send] (0x0100): Trying to resolve SRV record of
'_ldap._tcp.eurosel.az'
...
[resolve_srv_done] (0x0020): SRV query failed: [Domain name not found]
[set_srv_data_status] (0x0100): Marking SRV lookup of service 'IPA' 
as 'not

resolved'
[be_resolve_server_process] (0x0080): Couldn't resolve server (SRV 
lookup

meta-server), resolver returned (5)

DNS discovery of IPA server failed, becuase you just configured few 
hostnames

in /etc/hosts

You can add IP address or hostname to the option ipa_server
e.g.
 ipa_server = _srv_, vm-120.eurosel.az

BTW In my opinion, it is better to have

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server


On 14.10.2014 13:48, Orkhan Gasimov wrote:

I need further assistance with this moment:
specify IPA domain name which is sub-domain of you existing domain (e.g.
ipa.eurosel.az) .

Currently my FreeIPA server's hostname is ipa1.eurosel.az, and client's
hostname is bsd1.eurosel.az.
So when running this command:

ipa-server-install --setup-dns --forwarder ip address of your *existing* DNS
server,

the installation program detects the hostname of the VM (ipa1.eurosel.az) and
offers it as IPA server FQDN;
then it offers eurosel.az as the domain name. I can make changes right
during the installation process (FQDN = ipa1.ipa.eurosel.az  domain =
ipa.eurosel.az), but then there will be a conflict with the real hostname and
records in the /etc/hosts file.

On the other hand, if I change the hostname of the server VM to
ipa1.ipa.eurosel.az prior to running the IPA installation program, then the
installation program will offer my server an FQDN of ipa1.ipa.eurosel.az and
a domain name of ipa.eurosel.az. But doesn`t it mean that my client`s
hostname should also be changed to bsd1.ipa.eurosel.az? I`d like to avoid
this, because in production I won`t be able to change the domain part of FQDN
for hundreds of clients.


Clients don't need to be in the same domain as IPA. The IPA domain in DNS is 
necessary to store 'metadata' like SRV and TXT records etc.


You can even experiment with IPA servers which are not in the IPA domain but 
I'm not sure how much it was tested.


Alexander can add more details about records required for AD integration and 
how it should work with clients which are not in the IPA domain.


Petr^2 Spacek



14-Oct-14 16:29, Petr Spacek пишет:

On 14.10.2014 11:49, Orkhan Gasimov wrote:

I suspected that problems could arise with DNS, and here they are...

In fact, this entire string: ipa_server = _srv_ #our FreeIPA server has DNS
SRV entries was taken as-is from the how-to on FreeBSD forums. First I
commented it out, because was unsure sure if it was appropriate for my simple
setup with just 2 VMs and and a bunch of records in /etc/hosts file. After
starting sssd, I could get no IPA data withgetent passwd or getent group
commands. They I uncommented it and restarted sssd, but things remained the
same.

Now your advice is:  ...add IP address or hostname to the option ipa_server,
but you use an arbitrary name like vm-120.eurosel.az. Could you please
explain which host`s FQDN I should put there? If I use ipa1.eurosel.az, then
sssd won`t start (complains about ...Looping detected inside
krb5_get_in_tkt...).

If it MUST be a DNS server, then everything changes. And the question then
becomes: is it possible to set up a test FreeIPA client-server interaction
using only 2 VMs and proper records in /etc/hosts instead of a DNS server? Or
one MUST add a third VM and make it a DNS server to facilitate client-server
interaction?


IPA theoretically can work without DNS records but it requires very careful
configuration on clients and is strongly discouraged.

If you want to do quick  dirty test, do this:
$ ipa-server-install --setup-dns --forwarder ip address of your *existing*
DNS server
+ specify IPA domain name which is sub-domain of you existing domain (e.g.
ipa.eurosel.az)
+ change /etc/resolv.conf on *all* clients to point to IPA server

*This is a dirty trick* and it will not work unless all your clients has the
IPA server in resolv.conf. It will most likely break when you try to use AD
trust with AD clients etc.


*In production environment* you should add NS records for ipa.eurosel.az
domain to the parent DNS zone to create proper delegation. In that case you
don't need to fiddle with resolv.conf on all clients.

Let me know if you need further assistance.

Petr^2 Spacek



14-Oct-14 12:58, Lukas Slebodnik пишет:

On (14/10/14 10:23), Orkhan Gasimov wrote:

Thanks to both of you for the interest.
Here`s the info you asked:

1. Putting debug_level = 7 either in [domain] or/and [nss] section of the
/usr/local/etc/sssd/sssd.conf file gives nothing in the log. The log file
located at /var/log/sssd/sssd.log is only populated with data when I make
some errors in sssd.conf  sssd process fails to start. But that`s the case
only if I deliberately introduce some errors; with current configuration
sssd
starts successfully.

2. My original sssd.conf (without debugs) is as follows (exact copy of what
was shown in the post at FreeBSD forums):

-
[domain/mydomain.com]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = mydomain.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = ipa1.mydomain.com
chpass_provider = ipa
ipa_server = _srv_ #our FreeIPA server has DNS SRV entries


[resolv_getsrv_send] (0x0100): Trying to resolve SRV record of
'_ldap._tcp.eurosel.az'
...
[resolve_srv_done] (0x0020): SRV query failed: [Domain name not found]
[set_srv_data_status] (0x0100): Marking SRV lookup of service 'IPA' as 'not
resolved'

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server


So which way do I go?
1) Change the server VM`s hostname from ipa1.eurosel.az to 
ipa1.ipa.eurosel.az prior to issuing IPA installation command
2) or leave my hostname and contents of /etc/hosts file intact and 
specify a different FQDN and domain part of the IPA server after issuing 
IPA installation command?

Yes, I know - this is a question Homer Simpson would ask.


14-Oct-14 17:43, Petr Spacek пишет:

On 14.10.2014 13:48, Orkhan Gasimov wrote:

I need further assistance with this moment:
specify IPA domain name which is sub-domain of you existing domain 
(e.g.

ipa.eurosel.az) .

Currently my FreeIPA server's hostname is ipa1.eurosel.az, and client's
hostname is bsd1.eurosel.az.
So when running this command:

ipa-server-install --setup-dns --forwarder ip address of your 
*existing* DNS

server,

the installation program detects the hostname of the VM 
(ipa1.eurosel.az) and

offers it as IPA server FQDN;
then it offers eurosel.az as the domain name. I can make changes right
during the installation process (FQDN = ipa1.ipa.eurosel.az  domain =
ipa.eurosel.az), but then there will be a conflict with the real 
hostname and

records in the /etc/hosts file.

On the other hand, if I change the hostname of the server VM to
ipa1.ipa.eurosel.az prior to running the IPA installation program, 
then the
installation program will offer my server an FQDN of 
ipa1.ipa.eurosel.az and

a domain name of ipa.eurosel.az. But doesn`t it mean that my client`s
hostname should also be changed to bsd1.ipa.eurosel.az? I`d like to 
avoid
this, because in production I won`t be able to change the domain part 
of FQDN

for hundreds of clients.


Clients don't need to be in the same domain as IPA. The IPA domain in 
DNS is necessary to store 'metadata' like SRV and TXT records etc.


You can even experiment with IPA servers which are not in the IPA 
domain but I'm not sure how much it was tested.


Alexander can add more details about records required for AD 
integration and how it should work with clients which are not in the 
IPA domain.


Petr^2 Spacek



14-Oct-14 16:29, Petr Spacek пишет:

On 14.10.2014 11:49, Orkhan Gasimov wrote:

I suspected that problems could arise with DNS, and here they are...

In fact, this entire string: ipa_server = _srv_ #our FreeIPA 
server has DNS
SRV entries was taken as-is from the how-to on FreeBSD forums. 
First I
commented it out, because was unsure sure if it was appropriate for 
my simple
setup with just 2 VMs and and a bunch of records in /etc/hosts 
file. After
starting sssd, I could get no IPA data withgetent passwd or 
getent group
commands. They I uncommented it and restarted sssd, but things 
remained the

same.

Now your advice is:  ...add IP address or hostname to the option 
ipa_server,
but you use an arbitrary name like vm-120.eurosel.az. Could you 
please
explain which host`s FQDN I should put there? If I use 
ipa1.eurosel.az, then

sssd won`t start (complains about ...Looping detected inside
krb5_get_in_tkt...).

If it MUST be a DNS server, then everything changes. And the 
question then
becomes: is it possible to set up a test FreeIPA client-server 
interaction
using only 2 VMs and proper records in /etc/hosts instead of a DNS 
server? Or
one MUST add a third VM and make it a DNS server to facilitate 
client-server

interaction?


IPA theoretically can work without DNS records but it requires very 
careful

configuration on clients and is strongly discouraged.

If you want to do quick  dirty test, do this:
$ ipa-server-install --setup-dns --forwarder ip address of your 
*existing*

DNS server
+ specify IPA domain name which is sub-domain of you existing domain 
(e.g.

ipa.eurosel.az)
+ change /etc/resolv.conf on *all* clients to point to IPA server

*This is a dirty trick* and it will not work unless all your clients 
has the
IPA server in resolv.conf. It will most likely break when you try to 
use AD

trust with AD clients etc.


*In production environment* you should add NS records for 
ipa.eurosel.az
domain to the parent DNS zone to create proper delegation. In that 
case you

don't need to fiddle with resolv.conf on all clients.

Let me know if you need further assistance.

Petr^2 Spacek



14-Oct-14 12:58, Lukas Slebodnik пишет:

On (14/10/14 10:23), Orkhan Gasimov wrote:

Thanks to both of you for the interest.
Here`s the info you asked:

1. Putting debug_level = 7 either in [domain] or/and [nss] 
section of the
/usr/local/etc/sssd/sssd.conf file gives nothing in the log. The 
log file
located at /var/log/sssd/sssd.log is only populated with data 
when I make
some errors in sssd.conf  sssd process fails to start. But 
that`s the case
only if I deliberately introduce some errors; with current 
configuration

sssd
starts successfully.

2. My original sssd.conf (without debugs) is as follows (exact 
copy of what

was shown in the post at FreeBSD forums):

-
[domain/mydomain.com]
cache_credentials = True
krb5_store_password_if_offline

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server


On Tue, 14 Oct 2014, Orkhan Gasimov wrote:

So which way do I go?
1) Change the server VM`s hostname from ipa1.eurosel.az to 
ipa1.ipa.eurosel.az prior to issuing IPA installation command
2) or leave my hostname and contents of /etc/hosts file intact and 
specify a different FQDN and domain part of the IPA server after 
issuing IPA installation command?

Yes, I know - this is a question Homer Simpson would ask.

Allocate ipa.eurosel.az domain zone to FreeIPA and install FreeIPA with
integrated DNS. Essentially, (1), with domain=ipa.eurosel.az, realm
IPA.EUROSEL.AZ.

If you want later to see how this setup scales, all you would need to do
is to make sure the other clients would use ipa1.ipa.eurosel.az as a
resolver.




14-Oct-14 17:43, Petr Spacek пишет:

On 14.10.2014 13:48, Orkhan Gasimov wrote:

I need further assistance with this moment:
specify IPA domain name which is sub-domain of you existing 
domain (e.g.

ipa.eurosel.az) .

Currently my FreeIPA server's hostname is ipa1.eurosel.az, and client's
hostname is bsd1.eurosel.az.
So when running this command:

ipa-server-install --setup-dns --forwarder ip address of your 
*existing* DNS

server,

the installation program detects the hostname of the VM 
(ipa1.eurosel.az) and

offers it as IPA server FQDN;
then it offers eurosel.az as the domain name. I can make changes right
during the installation process (FQDN = ipa1.ipa.eurosel.az  domain =
ipa.eurosel.az), but then there will be a conflict with the real 
hostname and

records in the /etc/hosts file.

On the other hand, if I change the hostname of the server VM to
ipa1.ipa.eurosel.az prior to running the IPA installation 
program, then the
installation program will offer my server an FQDN of 
ipa1.ipa.eurosel.az and

a domain name of ipa.eurosel.az. But doesn`t it mean that my client`s
hostname should also be changed to bsd1.ipa.eurosel.az? I`d like 
to avoid
this, because in production I won`t be able to change the domain 
part of FQDN

for hundreds of clients.


Clients don't need to be in the same domain as IPA. The IPA domain 
in DNS is necessary to store 'metadata' like SRV and TXT records 
etc.


You can even experiment with IPA servers which are not in the IPA 
domain but I'm not sure how much it was tested.


Alexander can add more details about records required for AD 
integration and how it should work with clients which are not in the 
IPA domain.


Petr^2 Spacek



14-Oct-14 16:29, Petr Spacek пишет:

On 14.10.2014 11:49, Orkhan Gasimov wrote:

I suspected that problems could arise with DNS, and here they are...

In fact, this entire string: ipa_server = _srv_ #our FreeIPA 
server has DNS
SRV entries was taken as-is from the how-to on FreeBSD 
forums. First I
commented it out, because was unsure sure if it was 
appropriate for my simple
setup with just 2 VMs and and a bunch of records in /etc/hosts 
file. After
starting sssd, I could get no IPA data withgetent passwd or 
getent group
commands. They I uncommented it and restarted sssd, but things 
remained the

same.

Now your advice is:  ...add IP address or hostname to the 
option ipa_server,
but you use an arbitrary name like vm-120.eurosel.az. Could 
you please
explain which host`s FQDN I should put there? If I use 
ipa1.eurosel.az, then

sssd won`t start (complains about ...Looping detected inside
krb5_get_in_tkt...).

If it MUST be a DNS server, then everything changes. And the 
question then
becomes: is it possible to set up a test FreeIPA client-server 
interaction
using only 2 VMs and proper records in /etc/hosts instead of a 
DNS server? Or
one MUST add a third VM and make it a DNS server to facilitate 
client-server

interaction?


IPA theoretically can work without DNS records but it requires 
very careful

configuration on clients and is strongly discouraged.

If you want to do quick  dirty test, do this:
$ ipa-server-install --setup-dns --forwarder ip address of your 
*existing*

DNS server
+ specify IPA domain name which is sub-domain of you existing 
domain (e.g.

ipa.eurosel.az)
+ change /etc/resolv.conf on *all* clients to point to IPA server

*This is a dirty trick* and it will not work unless all your 
clients has the
IPA server in resolv.conf. It will most likely break when you 
try to use AD

trust with AD clients etc.


*In production environment* you should add NS records for 
ipa.eurosel.az
domain to the parent DNS zone to create proper delegation. In 
that case you

don't need to fiddle with resolv.conf on all clients.

Let me know if you need further assistance.

Petr^2 Spacek



14-Oct-14 12:58, Lukas Slebodnik пишет:

On (14/10/14 10:23), Orkhan Gasimov wrote:

Thanks to both of you for the interest.
Here`s the info you asked:

1. Putting debug_level = 7 either in [domain] or/and 
[nss] section of the
/usr/local/etc/sssd/sssd.conf file gives nothing in the 
log. The log file
located at /var/log/sssd/sssd.log is only populated with 
data when I make
some errors in sssd.conf  sssd process fails to start. 
But

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server


On 14.10.2014 15:06, Alexander Bokovoy wrote:

On Tue, 14 Oct 2014, Orkhan Gasimov wrote:

So which way do I go?
1) Change the server VM`s hostname from ipa1.eurosel.az to
ipa1.ipa.eurosel.az prior to issuing IPA installation command
2) or leave my hostname and contents of /etc/hosts file intact and specify a
different FQDN and domain part of the IPA server after issuing IPA
installation command?
Yes, I know - this is a question Homer Simpson would ask.

Allocate ipa.eurosel.az domain zone to FreeIPA and install FreeIPA with
integrated DNS. Essentially, (1), with domain=ipa.eurosel.az, realm
IPA.EUROSEL.AZ.

If you want later to see how this setup scales, all you would need to do
is to make sure the other clients would use ipa1.ipa.eurosel.az as a
resolver.


Again - in production it is unnecessary to change resolv.conf if you have 
proper NS records in place.


Petr^2 Spacek


14-Oct-14 17:43, Petr Spacek пишет:

On 14.10.2014 13:48, Orkhan Gasimov wrote:

I need further assistance with this moment:
specify IPA domain name which is sub-domain of you existing domain (e.g.
ipa.eurosel.az) .

Currently my FreeIPA server's hostname is ipa1.eurosel.az, and client's
hostname is bsd1.eurosel.az.
So when running this command:

ipa-server-install --setup-dns --forwarder ip address of your *existing*
DNS
server,

the installation program detects the hostname of the VM (ipa1.eurosel.az) and
offers it as IPA server FQDN;
then it offers eurosel.az as the domain name. I can make changes right
during the installation process (FQDN = ipa1.ipa.eurosel.az  domain =
ipa.eurosel.az), but then there will be a conflict with the real hostname and
records in the /etc/hosts file.

On the other hand, if I change the hostname of the server VM to
ipa1.ipa.eurosel.az prior to running the IPA installation program, then the
installation program will offer my server an FQDN of ipa1.ipa.eurosel.az
and
a domain name of ipa.eurosel.az. But doesn`t it mean that my client`s
hostname should also be changed to bsd1.ipa.eurosel.az? I`d like to avoid
this, because in production I won`t be able to change the domain part of FQDN
for hundreds of clients.


Clients don't need to be in the same domain as IPA. The IPA domain in DNS
is necessary to store 'metadata' like SRV and TXT records etc.

You can even experiment with IPA servers which are not in the IPA domain
but I'm not sure how much it was tested.

Alexander can add more details about records required for AD integration
and how it should work with clients which are not in the IPA domain.

Petr^2 Spacek



14-Oct-14 16:29, Petr Spacek пишет:

On 14.10.2014 11:49, Orkhan Gasimov wrote:

I suspected that problems could arise with DNS, and here they are...

In fact, this entire string: ipa_server = _srv_ #our FreeIPA server has
DNS
SRV entries was taken as-is from the how-to on FreeBSD forums. First I
commented it out, because was unsure sure if it was appropriate for my
simple
setup with just 2 VMs and and a bunch of records in /etc/hosts file. After
starting sssd, I could get no IPA data withgetent passwd or getent
group
commands. They I uncommented it and restarted sssd, but things remained the
same.

Now your advice is:  ...add IP address or hostname to the option
ipa_server,
but you use an arbitrary name like vm-120.eurosel.az. Could you please
explain which host`s FQDN I should put there? If I use
ipa1.eurosel.az, then
sssd won`t start (complains about ...Looping detected inside
krb5_get_in_tkt...).

If it MUST be a DNS server, then everything changes. And the question then
becomes: is it possible to set up a test FreeIPA client-server interaction
using only 2 VMs and proper records in /etc/hosts instead of a DNS
server? Or
one MUST add a third VM and make it a DNS server to facilitate
client-server
interaction?


IPA theoretically can work without DNS records but it requires very careful
configuration on clients and is strongly discouraged.

If you want to do quick  dirty test, do this:
$ ipa-server-install --setup-dns --forwarder ip address of your *existing*
DNS server
+ specify IPA domain name which is sub-domain of you existing domain (e.g.
ipa.eurosel.az)
+ change /etc/resolv.conf on *all* clients to point to IPA server

*This is a dirty trick* and it will not work unless all your clients has the
IPA server in resolv.conf. It will most likely break when you try to use AD
trust with AD clients etc.


*In production environment* you should add NS records for ipa.eurosel.az
domain to the parent DNS zone to create proper delegation. In that case you
don't need to fiddle with resolv.conf on all clients.

Let me know if you need further assistance.

Petr^2 Spacek



14-Oct-14 12:58, Lukas Slebodnik пишет:

On (14/10/14 10:23), Orkhan Gasimov wrote:

Thanks to both of you for the interest.
Here`s the info you asked:

1. Putting debug_level = 7 either in [domain] or/and [nss] section
of the
/usr/local/etc/sssd/sssd.conf file gives nothing in the log. The log file
located at

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server