On 05/29/2014 02:20 PM, Scott Allen wrote:
Hi,
Having a particularly weird problem. We have moved from AD to freeIPA recently and while there have been some bumps, most of the CentOS 6.2 boxes make the transition successfully. Some background.

The Linux boxes were joined to AD on Windows 2008R2 using samba/winbind. When we moved from AD, boxes were not "removed" from AD, just disabled on the server side. We scripted the necessary bits since we were moving to a new subnet as well. The script runs "ipa-client-install -p admin --password PASSWORD --enable-dns-updates -U"

The machines were joined successfully to freeIPA and then added to allow_all_hosts Host Group.

On a workstation that was migrated, all users can successfully log in.
On a fresh install of CentOS6.2, only myself (admin_user) and a newly created user (foo) can successfully log in.

On this fresh install, 'david' is blocked but new user 'foo' is allowed.

May 29 09:20:29 embassy419 polkitd(authority=local): Registered Authentication Agent for session /org/freedesktop/ConsoleKit/Session1 (system bus name :1.26 [/usr/libexec/polkit-gnome-authentication-agent-1], object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) May 29 09:20:46 embassy419 pam: gdm-password[2910]: pam_unix(gdm-password:auth): authentication failure; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=david May 29 09:20:47 embassy419 pam: gdm-password[2910]: pam_sss(gdm-password:auth): system info: [Preauthentication failed] May 29 09:20:47 embassy419 pam: gdm-password[2910]: pam_sss(gdm-password:auth): authentication failure; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=david May 29 09:20:47 embassy419 pam: gdm-password[2910]: pam_sss(gdm-password:auth): received for user david: 17 (Failure setting user credentials) May 29 10:44:06 embassy419 polkitd(authority=local): Registered Authentication Agent for session /org/freedesktop/ConsoleKit/Session3 (system bus name :1.88 [/usr/libexec/polkit-gnome-authentication-agent-1], object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) May 29 10:44:13 embassy419 pam: gdm-password[3956]: pam_unix(gdm-password:auth): authentication failure; logname= uid=0 euid=0 tty=:1 ruser= rhost= user=foo May 29 10:44:14 embassy419 pam: gdm-password[3956]: pam_sss(gdm-password:auth): authentication success; logname= uid=0 euid=0 tty=:1 ruser= rhost= user=foo May 29 10:44:14 embassy419 pam: gdm-password[3956]: pam_unix(gdm-password:session): session opened for user foo by (uid=0) May 29 10:44:15 embassy419 polkitd(authority=local): Unregistered Authentication Agent for session /org/freedesktop/ConsoleKit/Session3 (system bus name :1.88, object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)

But on this machine that was migrated.
pam: gdm-password[14145]: pam_unix(gdm-password:auth): authentication failure; logname= uid=0 euid=0 tty=:1 ruser= rhost= user=david May 29 10:42:08 Embassy426 pam: gdm-password[14145]: pam_sss(gdm-password:auth): system info: [Preauthentication failed] May 29 10:42:08 Embassy426 pam: gdm-password[14145]: pam_sss(gdm-password:auth): authentication failure; logname= uid=0 euid=0 tty=:1 ruser= rhost= user=david May 29 10:42:08 Embassy426 pam: gdm-password[14145]: pam_sss(gdm-password:auth): received for user david: 17 (Failure setting user credentials) May 29 10:42:08 Embassy426 pam: gdm-password[14145]: pam_winbind(gdm-password:auth): getting password (0x00000010) May 29 10:42:08 Embassy426 pam: gdm-password[14145]: pam_winbind(gdm-password:auth): pam_get_item returned a password May 29 10:42:09 Embassy426 pam: gdm-password[14145]: pam_winbind(gdm-password:auth): user 'david' granted access May 29 10:42:09 Embassy426 pam: gdm-password[14145]: pam_winbind(gdm-password:account): valid_user: wbcGetpwnam gave WBC_ERR_DOMAIN_NOT_FOUND May 29 10:42:10 Embassy426 pam: gdm-password[14145]: pam_unix(gdm-password:session): session opened for user david by (uid=0) May 29 10:42:10 Embassy426 polkitd(authority=local): Unregistered Authentication Agent for session /org/freedesktop/ConsoleKit/Session3 (system bus name :1.85, object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus) May 29 10:42:11 Embassy426 polkitd(authority=local): Registered Authentication Agent for session /org/freedesktop/ConsoleKit/Session4 (system bus name :1.105 [/usr/libexec/polkit-gnome-authentication-agent-1], object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) May 29 10:42:56 Embassy426 pam: gdm-password[15052]: pam_unix(gdm-password:auth): authentication failure; logname= uid=0 euid=0 tty=:3 ruser= rhost= user=foo May 29 10:42:57 Embassy426 pam: gdm-password[15052]: pam_sss(gdm-password:auth): authentication success; logname= uid=0 euid=0 tty=:3 ruser= rhost= user=foo May 29 10:42:57 Embassy426 pam: gdm-password[15052]: pam_winbind(gdm-password:account): valid_user: wbcGetpwnam gave WBC_ERR_DOMAIN_NOT_FOUND May 29 10:42:59 Embassy426 pam: gdm-password[15052]: pam_unix(gdm-password:session): session opened for user foo by (uid=0) May 29 10:42:59 Embassy426 polkitd(authority=local): Unregistered Authentication Agent for session /org/freedesktop/ConsoleKit/Session7 (system bus name :1.160, object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus) May 29 10:42:59 Embassy426 polkitd(authority=local): Registered Authentication Agent for session /org/freedesktop/ConsoleKit/Session8 (system bus name :1.175 [/usr/libexec/polkit-gnome-authentication-agent-1], object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)


The dirserv says this about david from the broken PC

[29/May/2014:09:20:46 -0700] conn=8 op=1526 SRCH base="dc=embassy,dc=vfx" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincip al))(|(ipaKrbPrincipalAlias=da...@embassy.vfx)(krbPrincipalName=da...@embassy.vfx)))" attrs="krbPrincipalName krbCanonicalName ipaKrbPrincipalAlias krbUPEnabled krbPrincipalKe y krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSucces sfulAuth krbLastFailedAuth krbLoginFailedCount krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHis
tory objectClass"
[29/May/2014:09:20:46 -0700] conn=8 op=1526 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2014:09:20:46 -0700] conn=8 op=1527 SRCH base="cn=EMBASSY.VFX,cn=kerberos,dc=embassy,dc=vfx" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife
krbMaxRenewableAge krbTicketFlags"
[29/May/2014:09:20:46 -0700] conn=8 op=1527 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2014:09:20:46 -0700] conn=8 op=1528 SRCH base="dc=embassy,dc=vfx" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincip al))(|(ipaKrbPrincipalAlias=krbtgt/embassy....@embassy.vfx)(krbPrincipalName=krbtgt/embassy....@embassy.vfx)))" attrs="krbPrincipalName krbCanonicalName ipaKrbPrincipalAlias k rbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrin cipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge
 nsAccountLock passwordHistory objectClass"
[29/May/2014:09:20:46 -0700] conn=8 op=1528 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2014:09:20:46 -0700] conn=8 op=1529 SRCH base="cn=global_policy,cn=EMBASSY.VFX,cn=kerberos,dc=embassy,dc=vfx" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krb MinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration" [29/May/2014:09:20:46 -0700] conn=8 op=1529 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2014:09:20:46 -0700] conn=8 op=1530 MOD dn="uid=david,cn=users,cn=accounts,dc=embassy,dc=vfx" [29/May/2014:09:20:46 -0700] conn=8 op=1530 RESULT err=0 tag=103 nentries=0 etime=0 csn=53875e73000000030000

From a Migrated working machine (more debugging turned on)
[29/May/2014:10:42:04 -0700] conn=72 op=14 SRCH base="cn=accounts,dc=embassy,dc=vfx" scope=2 filter="(&(uid=david)(objectClass=posixAccount))" attrs="objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn memberOf nsUniqueId modifyTimestamp entryusn shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdattribute authorizedService accountexpires useraccountcontrol nsAccountLock host logindisabled loginexpirationtime loginallowedtimemap ipaSshPubKey" [29/May/2014:10:42:04 -0700] conn=72 op=14 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2014:10:42:08 -0700] conn=72 op=15 SRCH base="cn=accounts,dc=embassy,dc=vfx" scope=2 filter="(&(uid=david)(objectClass=posixAccount))" attrs="objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn memberOf nsUniqueId modifyTimestamp entryusn shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdattribute authorizedService accountexpires useraccountcontrol nsAccountLock host logindisabled loginexpirationtime loginallowedtimemap ipaSshPubKey" [29/May/2014:10:42:08 -0700] conn=72 op=15 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2014:10:42:08 -0700] conn=72 op=16 SRCH base="cn=ipausers,cn=groups,cn=accounts,dc=embassy,dc=vfx" scope=0 filter="(&(objectClass=posixGroup)(cn=*))" attrs="objectClass cn userPassword gidNumber member nsUniqueId modifyTimestamp entryusn" [29/May/2014:10:42:08 -0700] conn=72 op=16 RESULT err=0 tag=101 nentries=0 etime=0 [29/May/2014:10:42:08 -0700] conn=72 op=17 SRCH base="cn=emb_users,cn=groups,cn=accounts,dc=embassy,dc=vfx" scope=0 filter="(&(objectClass=posixGroup)(cn=*))" attrs="objectClass cn userPassword gidNumber member nsUniqueId modifyTimestamp entryusn" [29/May/2014:10:42:08 -0700] conn=72 op=17 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2014:10:42:08 -0700] conn=72 op=18 SRCH base="cn=etc,dc=embassy,dc=vfx" scope=2 filter="(&(cn=ipaConfig)(objectClass=ipaGuiConfig))" attrs="ipaMigrationEnabled ipaSELinuxUserMapDefault ipaSELinuxUserMapOrder" [29/May/2014:10:42:08 -0700] conn=72 op=18 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2014:10:42:08 -0700] conn=72 op=19 SRCH base="cn=accounts,dc=embassy,dc=vfx" scope=2 filter="(&(objectClass=ipaHost)(fqdn=embassy426.embassy.vfx))" attrs="objectClass cn fqdn serverHostName memberOf ipaSshPubKey ipaUniqueID" [29/May/2014:10:42:08 -0700] conn=72 op=19 RESULT err=0 tag=101 nentries=1 etime=0 notes=P [29/May/2014:10:42:08 -0700] conn=72 op=20 SRCH base="fqdn=embassy426.embassy.vfx,cn=computers,cn=accounts,dc=embassy,dc=vfx" scope=0 filter="(objectClass=*)" attrs="objectClass cn memberOf ipaUniqueID" [29/May/2014:10:42:08 -0700] conn=72 op=20 RESULT err=0 tag=101 nentries=1 etime=0 notes=P [29/May/2014:10:42:08 -0700] conn=72 op=21 SRCH base="cn=hbac,dc=embassy,dc=vfx" scope=2 filter="(objectClass=ipaHBACService)" attrs="objectClass cn ipaUniqueID member memberOf" [29/May/2014:10:42:08 -0700] conn=72 op=21 RESULT err=0 tag=101 nentries=15 etime=0 notes=P [29/May/2014:10:42:08 -0700] conn=72 op=22 SRCH base="cn=hbac,dc=embassy,dc=vfx" scope=2 filter="(objectClass=ipaHBACServiceGroup)" attrs="objectClass cn ipaUniqueID member memberOf" [29/May/2014:10:42:08 -0700] conn=72 op=22 RESULT err=0 tag=101 nentries=2 etime=0 notes=P [29/May/2014:10:42:08 -0700] conn=72 op=23 SRCH base="cn=hbac,dc=embassy,dc=vfx" scope=2 filter="(&(objectClass=ipaHBACRule)(ipaEnabledFlag=TRUE)(|(hostCategory=all)(memberHost=fqdn=embassy426.embassy.vfx,cn=computers,cn=accounts,dc=embassy,dc=vfx)(memberHost=cn=allow_all_hosts,cn=hostgroups,cn=accounts,dc=embassy,dc=vfx)(memberHost=cn=allow_all_hosts,cn=ng,cn=alt,dc=embassy,dc=vfx)(memberHost=ipauniqueid=6e07ee2e-d495-11e3-9c3b-00304881a4bc,cn=hbac,dc=embassy,dc=vfx)))" attrs="objectClass cn ipaUniqueID ipaEnabledFlag accessRuleType memberUser userCategory memberService serviceCategory sourceHost sourceHostCategory externalHost memberHost hostCategory" [29/May/2014:10:42:08 -0700] conn=72 op=23 RESULT err=0 tag=101 nentries=1 etime=0 notes=P [29/May/2014:10:42:08 -0700] conn=72 op=24 SRCH base="cn=etc,dc=embassy,dc=vfx" scope=2 filter="(&(cn=ipaConfig)(objectClass=ipaGuiConfig))" attrs="ipaMigrationEnabled ipaSELinuxUserMapDefault ipaSELinuxUserMapOrder" [29/May/2014:10:42:08 -0700] conn=72 op=24 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2014:10:42:08 -0700] conn=72 op=25 SRCH base="cn=selinux,dc=embassy,dc=vfx" scope=2 filter="(&(objectClass=ipaselinuxusermap)(ipaEnabledFlag=TRUE))" attrs="objectClass cn memberUser memberHost seeAlso ipaSELinuxUser ipaEnabledFlag userCategory hostCategory ipaUniqueID" [29/May/2014:10:42:08 -0700] conn=72 op=25 RESULT err=0 tag=101 nentries=0 etime=0 notes=P [29/May/2014:10:42:09 -0700] conn=72 op=26 SRCH base="cn=accounts,dc=embassy,dc=vfx" scope=2 filter="(&(cn=pulse-rt)(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))" attrs="objectClass cn userPassword gidNumber member nsUniqueId modifyTimestamp entryusn" [29/May/2014:10:42:09 -0700] conn=72 op=26 RESULT err=0 tag=101 nentries=0 etime=1 [29/May/2014:10:42:09 -0700] conn=72 op=27 SRCH base="cn=accounts,dc=embassy,dc=vfx" scope=2 filter="(&(gidNumber=16777729)(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))" attrs="objectClass cn userPassword gidNumber member nsUniqueId modifyTimestamp entryusn" [29/May/2014:10:42:09 -0700] conn=72 op=27 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2014:10:42:09 -0700] conn=72 op=28 SRCH base="cn=emb_users,cn=groups,cn=accounts,dc=embassy,dc=vfx" scope=0 filter="(objectClass=*)" attrs="objectClass cn userPassword gidNumber member nsUniqueId modifyTimestamp entryusn uid" [29/May/2014:10:42:09 -0700] conn=72 op=28 RESULT err=0 tag=101 nentries=1 etime=0 notes=P


I can see that winbind is somehow involved but
1) Both machines are disabled in AD
2) The new user 'foo' is not in AD but can still log in

I have tried copying over the pam.d folder from a working PC with no luck as well. The weird part is the migrated machine behaves "better" than the clean install.....
Anything leap out? I can send more info if required.


With david auth goes to IPA and fails somehow. Check Kerberos logs. That might have some hints. May be it is because the password needs to be changed for him after migration. Since you have winbind in the stack still it kicks in and tries. Authentication seems to work because it is just Kerberos but the authorization fails so user can't log in.
User foo was properly created so he can authenticate.
I suspect that migration was not properly completed. Please check documentation about migration.



Thanks
Scott A

--
Scott Allen
Head of IT
The Embassy Visual Effects Inc.
4th Floor - 177 W 7th Avenue
Vancouver, B.C.
V5Y 1L8
604.696.6862 ext 241


_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users


--
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.

_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Reply via email to