0

I build a trust relationship between FreeIPA and AD, and add some AD users to FreeIPA server, all those users can successfully login to IPA server side. But can login to IPA client. Here is the command I used to add workstations to FreeIPA

ipa-client-install -U -f --enable-dns-updates --domain example.com --ntp-server=phoenix.example.com --server=phoenix.example.com -p EXAMPLE.COM -p admin -w '$EXAMPLE' --hostname=$HOSTNAME --automount-location=default --no-dns-sshfp --preserve-sssd

And after check the /var/log/message and /var/log/secure I got this warning

/var/log/secure :

Jan 24 15:19:00 greentag sshd[2092]: Received disconnect from 192.168.5.222: 11: disconnected by user Jan 24 15:19:00 greentag sshd[2092]: pam_unix(sshd:session): session closed for user root Jan 24 15:19:12 greentag sshd[3856]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 user=isaac@adexample.com Jan 24 15:19:12 greentag sshd[3856]: pam_sss(sshd:auth): received for user isaac@adexample.com: 6 (Permission denied) Jan 24 15:19:12 greentag sshd[3838]: error: PAM: Authentication failure for isaac@adexample.com from 192.168.5.222 Jan 24 15:19:16 greentag sshd[3892]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 user=isaac@adexample.com Jan 24 15:19:16 greentag sshd[3892]: pam_sss(sshd:auth): received for user isaac@adexample.com: 6 (Permission denied) Jan 24 15:19:16 greentag sshd[3838]: error: PAM: Authentication failure for isaac@adexample.com from 192.168.5.222 Jan 24 15:19:16 greentag sshd[3838]: Postponed keyboard-interactive for isaac@adexample.com from 192.168.5.222 port 45318 ssh2 [preauth] Jan 24 15:19:19 greentag sshd[3895]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 user=isaac@adexample.com Jan 24 15:19:19 greentag sshd[3895]: pam_sss(sshd:auth): received for user isaac@adexample.com: 6 (Permission denied) Jan 24 15:19:19 greentag sshd[3838]: error: PAM: Authentication failure for isaac@adexample.com from 192.168.5.222 Jan 24 15:19:26 greentag sshd[3838]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 user=isaac@adexample.com Jan 24 15:19:26 greentag sshd[3838]: pam_sss(sshd:auth): received for user isaac@adexample.com: 6 (Permission denied) Jan 24 15:19:26 greentag sshd[3838]: Failed password for isaac@adexample.com from 192.168.5.222 port 45318 ssh2 Jan 24 15:19:30 greentag sshd[3838]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 user=isaac@adexample.com Jan 24 15:19:30 greentag sshd[3838]: pam_sss(sshd:auth): received for user isaac@adexample.com: 6 (Permission denied) Jan 24 15:19:30 greentag sshd[3838]: Failed password for isaac@adexample.com from 192.168.5.222 port 45318 ssh2

/var/log/message : Jan 24 15:19:12 greentag [sssd[krb5_child[3889]]]: Cannot find KDC for realm "adexample.COM" Jan 24 15:19:12 greentag [sssd[krb5_child[3889]]]: Cannot find KDC for realm "adexample.COM" Jan 24 15:19:12 greentag [sssd[krb5_child[3890]]]: Cannot find KDC for realm "adexample.COM" Jan 24 15:19:12 greentag [sssd[krb5_child[3890]]]: Cannot find KDC for realm "adexample.COM"

But when I type id isaac@adexample.com it will show me this user information.

0

Problem solved, it seems like I need to open the corresponding port manually. Edit /etc/sysconfig/iptables, append this

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
# -A INPUT -s ad_ip_address -p tcp -m multiport --dports 389,636 -m state --state NEW,ESTABLISHED -j REJECT
-A INPUT -p tcp -m multiport --dports 80,88,443,389,636,88,464,53,138,139,445 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m multiport --dports 88,464,53,123,138,139,389,445 -m state --state NEW,ESTABLISHED -j ACCEPT 
-A INPUT -p udp -j REJECT
-A INPUT -p tcp -j REJECT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.