Freeradius Kerberos Authentication to FreeIPA
I got the authentication working. I enrolled the radius server in IPA and created the service. Then on the radius server I got the key tab with the ipa-getkeytab command and the ticket with kinit. Everything works fine for 24 hours, which is the time when the ticket expires, then I have to reissue the aforementioned commands to get the service working again. Any ideas on how to fix this?. Thanks.-
On 18 Jul 2018, at 19:56, Guille <godoy.guillermo@gmail.com> wrote:
Any ideas on how to fix this?.
Sounds like you're not actually using the keytab - you should only need a ticket to generate the keytab in the first place. Take a look at this post I wrote a couple of years ago: http://lists.freeradius.org/pipermail/freeradius-users/2015-February/075624.... Make sure FreeRADIUS is actually running as the user account you think it is running as, and that it can definitely read the keytab (check file permissions, selinux, etc.). Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
Yes, that's the exact post I was following to get my configuration working. I'm pretty positive about the permission on the keytab file since I got it wrong at first and the service just didn't work. My klist looks like this: [root@freeradius01 raddb]# klist Ticket cache: KEYRING:persistent:0:krb_ccache_L7W1CRR Default principal: radius/freeradius01.gti.copaco.com.py@GTI.COPACO.COM.PY Valid starting Expires Service principal 18/07/18 13:31:00 19/07/18 13:31:00 krbtgt/ GTI.COPACO.COM.PY@GTI.COPACO.COM.PY On Wed, Jul 18, 2018 at 3:07 PM Adam Bishop <Adam.Bishop@jisc.ac.uk> wrote:
On 18 Jul 2018, at 19:56, Guille <godoy.guillermo@gmail.com> wrote:
Any ideas on how to fix this?.
Sounds like you're not actually using the keytab - you should only need a ticket to generate the keytab in the first place.
Take a look at this post I wrote a couple of years ago:
http://lists.freeradius.org/pipermail/freeradius-users/2015-February/075624....
Make sure FreeRADIUS is actually running as the user account you think it is running as, and that it can definitely read the keytab (check file permissions, selinux, etc.).
Adam Bishop
gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460
jisc.ac.uk
Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 18 Jul 2018, at 20:23, Guille <godoy.guillermo@gmail.com> wrote:
[root@freeradius01 raddb]# klist
Unless you've changed the default config, freeradius runs (on centos) as radiusd and not root - I'm not sure what the behaviour will be If you've configured things as root. Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
Yes, you're right, It's running as radiusd, I'm using Fedora Server. Also, I've placed the keytab in /etc/raddb and was owned by root.radiusd with 640 permissions. Now I've placed it in /var/lib/radiusd as your post suggested, and it's owned by radiusd.radiusd. I'll let you know If things change. Thank you. On Thu, Jul 19, 2018 at 8:01 AM Adam Bishop <Adam.Bishop@jisc.ac.uk> wrote:
On 18 Jul 2018, at 20:23, Guille <godoy.guillermo@gmail.com> wrote:
[root@freeradius01 raddb]# klist
Unless you've changed the default config, freeradius runs (on centos) as radiusd and not root - I'm not sure what the behaviour will be If you've configured things as root.
Adam Bishop
gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460
jisc.ac.uk
Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Adam Bishop -
Guille