Dotaz: Pomoc s Kerberosem

[2012]

Ahoj, snazim se zprovoznit RedHat virtualizaci (nebo Ovirt chcete-li) a napojeni na IDM.

Dostal jsem se celkem daleko, ze se zaloguji z Ovirt na IDM (FreeIpa), s LDAP uctem admina, heslo je v te LDAP DB jako hash.

Jenze ta FreeIPA je mimo jine take nastavena jako proxy na AD, takze tam jsou ucty z Kerbera. A tady je trochu potiz.

Aby to fungovalo, je v navodu toto:

On the KDC server, use the kadmin utility to create a service principal for the Apache service on the oVirt Engine. The service principal is a reference ID to the KDC for the Apache service.

# kadmin
kadmin> addprinc -randkey HTTP/fqdn-of-rhevm@REALM.COM
Generate a keytab file for the Apache service. The keytab file stores the shared secret key.

The engine-backup command includes the file /etc/httpd/http.keytab when backing up and restoring. If you use a different name for the keytab file, make sure you back up and restore it.

kadmin> ktadd -k /tmp/http.keytab HTTP/fqdn-of-rhevm@REALM.COM
kadmin> quit

Tady bych potreboval trochu pomoct, s Kerberem az tolik neumim. Pry se porusuje nejaky constraint.

[root@freeipa ~]# kadmin
Authenticating as principal kadmin/admin@TEST.LOCAL with password.
Password for kadmin/admin@TEST.LOCAL:
kadmin:
kadmin:  addprinc -randkey HTTP/rhvm.test.local@TEST.LOCAL
No policy specified for HTTP/rhvm.test.local@TEST.LOCAL; defaulting to no policy
add_principal: Kerberos database constraints violated while creating "HTTP/rhvm.test.local@TEST.LOCAL".
kadmin:

V "/var/kerberos/krb5kdc/kadm5.acl" mam:

*/admin@TEST.LOCAL     *

---

---

Odpovědi

[j]

Rek bych, ze se snazis vytvorit duplicitni SPNko, takze se to tomu brani.

Takze kdyz je tam add, tak tam zcela jiste bude list/print/... neco na to tema (neznam to) a vypis si co tam je.

A vazne neni dobry opisovat nejakej navod aniz bys tusil co delas.

---

Dete s tim guuglem dopice!

[2012]

Jojo, dekuju. Co se tyce duplicit, principal, ktery se tam snazim zadat v te DB neni, snazim se tam dostat:

HTTP/rhvm.test.local@TEST.LOCAL

Aktualne v te Freeipe je:

kadmin:  listprincs
admin@TEST.LOCAL
K/M@TEST.LOCAL
krbtgt/TEST.LOCAL@TEST.LOCAL
kadmin/freeipa.TEST.local@TEST.LOCAL
kadmin/admin@TEST.LOCAL
kadmin/changepw@TEST.LOCAL
kiprop/freeipa.TEST.local@TEST.LOCAL
ldap/freeipa.TEST.local@TEST.LOCAL
host/freeipa.TEST.local@TEST.LOCAL
WELLKNOWN/ANONYMOUS@TEST.LOCAL
dogtag/freeipa.TEST.local@TEST.LOCAL
HTTP/freeipa.TEST.local@TEST.LOCAL
cifs/freeipa.TEST.local@TEST.LOCAL
aftersync@TEST.LOCAL
test5@TEST.LOCAL
krbtgt/TEST.LOCAL@NETTEST.LOCAL
krbtgt/TEST@NETTEST.LOCAL
kadmin:

Taky si tak trochu myslim, jestli se to vubec dela stejne. Ten navod je pro LDAP a Kerboros, ja mam FreeIPU. Nicmene nejake principy ciste z Kerberos by snad platit mohly. Jdu zatim hledat, co dela ten ktadd.

[X]

Ta chyba je celkem bezna a problem je v tom, ze IPA spravuje Kerberos za tebe. => Je potreba pouzit nastroje ipa a ne kadmin. V tomto pripade to bude nejspis 'ipa service-add ..' Zkus si projit nejake navody..

[2012]

Aha ok, mrknu zitra.

[2012]

Pro FreeIPu jsem keytab nutny pro ten kerberos modul Ovirtu vygeneroval takto:

[root@freeipa ~]# ipa host-add --force --ip-address=10.30.237.37 rhvh.test.local
-----------------------------
Added host "rhvh.test.local"
-----------------------------
  Host name: rhvh.test.local
  Principal name: host/rhvh.test.local@TEST.LOCAL
  Principal alias: host/rhvh.test.local@TEST.LOCAL
  Password: False
  Keytab: False
  Managed by: rhvh.test.local

[root@freeipa ~]# ipa service-add --force HTTP/rhvh.test.local@TEST.LOCAL
-------------------------------------------------
Added service "HTTP/rhvh.test.local@TEST.LOCAL"
-------------------------------------------------
  Principal name: HTTP/rhvh.test.local@TEST.LOCAL
  Principal alias: HTTP/rhvh.test.local@TEST.LOCAL
  Managed by: rhvh.test.local

[root@freeipa ~]# ipa-getkeytab -s freeipa.test.local -p HTTP/rhvh.test.local -k /etc/httpd/conf/ipa.keytab
Keytab successfully retrieved and stored in: /etc/httpd/conf/ipa.keytab

Dekuji.

[Ivan]

kadmin je tool pro management MIT Kerberos serveru. AD kerberos od MS s nim managovat nemuzes, i kdyz hodne navodu na netu je zavadejicich. Pridat SPN muzes bud spustenim prikazu na AD serveru, anebo pouzij MS AD utils.

Microsoft vytvoril v go aplikaci, kterou muzes managovat jejich AD i z Linuxu. PS: tvoje problemy tim nekonci, protoze na vytvroeni SPN potrebuje celkem specificky prava.

[j]

Jestli to je widli AD srv, tak setspn je ten spravnej widlo tool. Domenovej admin to pak jisti ten to muze.

A funguje to teda i z klienta, netreba to poustet na serveru.

Pocitam ze by to mohlo mit nejakou powershell alternaci, a tudiz by to mohlo jit (s tim powershellem) udelat i z tuxe.

https://stackoverflow.com/questions/21941047/powershell-replacement-for-setspn

Chmm

---

Dete s tim guuglem dopice!

[2012]

Nene, je to FreeIPA nastavena jako proxy na AD.

[Ivan]

Jako ze IPA se pripojuje k AD pres LDAP a kerberos server je na Linuxu? Tak to beru vse zpatky.

[2012]

Ano je nastaveny trust na AD cimz padem, Kerberos na FreeIPE leze s dotazy rovnou na AD.

[Ivan]

Ten adutil je popsanej tady (puvodne to asi bylo vyvinuty pro MS SQL server na Linuxu) https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-ad-auth-adutil-tutorial?view=sql-server-ver15

adutil spn addauto -n sqluser -s MSSQLSvc -H mymachine.contoso.com -p 1433 

Dalsi moznost je leave a join AD. Na oboje operace jsou potreba celkem minimalni prava (full control nad nejakym kontejnerem v AD) a behem join AD si muzes rict jaky SPN ches pro svuj server. Pro pridani SPN k serveru potrebuje prava admina.

Napr:

adcli join --domain-ou='OU=Servers,DC=prod' -V 'ORACLE' --show-details --show-password -v -U dbadmin
...
 * Discovered which keytab salt to use
 * Added the entries to the keytab: RHEL7A-19-RESTA$@PROD: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: ORACLE/RHEL7A-19-RESTA@PROD: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: ORACLE/rhel7a-19-restart.prod@PROD: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: host/RHEL7A-19-RESTA@PROD.VMWARE.HAF: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: host/rhel7a-19-restart.prod@PROD: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: RestrictedKrbHost/RHEL7A-19-RESTA@PROD: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: RestrictedKrbHost/rhel7a-19-restart.prod@PROD: FILE:/etc/krb5.keytab

Tohle vytvori dalsi SPN "ORACLE" pro Linux server, ktery joinuje AD.