12:51 p.m.
On 18/11/13 18:41, Juan Hernandez wrote:
On 11/18/2013 06:37 PM, Jonas Israelsson wrote:
> On 18/11/13 18:26, Juan Hernandez wrote:
>> On 11/18/2013 06:21 PM, Jonas Israelsson wrote:
>>> On 18/11/13 17:24, Juan Hernandez wrote:
>>>> On 11/18/2013 12:17 PM, Jonas Israelsson wrote:
>>>>> On 17/10/13 17:22, Juan Hernandez wrote:
>>>>>> On 10/17/2013 05:15 PM, Itamar Heim wrote:
>>>>>>> On 10/17/2013 09:57 AM, Jonas Israelsson wrote:
>>>>>>>> I saw that openldap is now listed as a provider when
invoking
>>>>>>>> engine-manage-domains. I'm eager to find more
information about this.
>>>>>>>> Does anyone know if there is any updated documentation
floating around
>>>>>>>> somewhere ?
>>>>>>>>
>>>>>>>> Found this:http://www.ovirt.org/LDAP_Quick_Start
>>>>>>>>
>>>>>>>> But the article seem only half-finished.
>>>>>>>>
>>>>>>>> Rgds Jonas
>>>>>>>>
>>>>>>> this may help you.
>>>>>>> https://bugzilla.redhat.com/show_bug.cgi?id=967327#c4
>>>>>>> https://bugzilla.redhat.com/show_bug.cgi?id=967327#c5
>>>>>>>
>>>>>>> help finishing the wiki would be great...
>>>>>>>
>>>>>>> thanks,
>>>>>>> Itamar
>>>>>>>
>>>>>> I am attaching slightly updated notes on how to configure
OpenLDAP and
>>>>>> Kerberos for both Fedora and RHEL/CentOS.
>>>>>>
>>>> I just updated the wiki with the latest version of the instructions that
>>>> I use. I think they work. Any enhancement is welcome.
>>>>
>>>>> Anyone knows if ovirt is able to handle that the kdc and directory
>>>>> service are running on separate hosts ? In my environment this is
the
>>>>> case where the kdc is located at a service with it's own name/IP
>>>>> (admin.elementary.se), and the directory-service on
ldap.elementary.se.
>>>>> Even though I see both names are resolved by a name server lookup a
>>>>> network sniffer trace shows that later (ldap.elementary.se) used for
>>>>> both kerberos and ldap access.
>>>>>
>>>> By default oVirt uses the Kerberos and LDAP servers that are provided by
>>>> DNS. Can you please check what is the result of the following DNS query?
>>>>
>>>> # dig -t SRV _kerberos._tcp.elementary.se
>>> All DNS querys gets the correct answer (both forward and reverse)
>>>
>>> Engine -- 192.168.24.217 -- dashboard.elementary.se
>>> LDAP-Server -- 192.168.24.239 -- ldap.elementary.se
>>> KDC -- 192.168.24.240 -- admin.elementary.se
>>>
>>> dig -t SRV _kerberos._tcp.elementary.se
>>>
>>> ; <<>> DiG 9.9.3-rpz2+rl.156.01-P2 <<>> -t SRV
_kerberos._tcp.elementary.se
>>> ;; global options: +cmd
>>> ;; Got answer:
>>> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19187
>>> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 4
>>>
>>> ;; OPT PSEUDOSECTION:
>>> ; EDNS: version: 0, flags:; udp: 4096
>>> ;; QUESTION SECTION:
>>> ;_kerberos._tcp.elementary.se. IN SRV
>>>
>>> ;; ANSWER SECTION:
>>> _kerberos._tcp.elementary.se. 3600 IN SRV 0 0 88 admin.elementary.se.
>>>
>>> ;; AUTHORITY SECTION:
>>> elementary.se. 3600 IN NS ns2.elementary.se.
>>> elementary.se. 3600 IN NS ns1.elementary.se.
>>>
>>> ;; ADDITIONAL SECTION:
>>> admin.elementary.se. 3600 IN A 192.168.24.240
>>> ns1.elementary.se. 3600 IN A 192.168.24.231
>>> ns2.elementary.se. 3600 IN A 192.168.24.232
>>>
>>> ;; Query time: 0 msec
>>> ;; SERVER: 192.168.24.231#53(192.168.24.231)
>>> ;; WHEN: Mon Nov 18 18:05:05 CET 2013
>>> ;; MSG SIZE rcvd: 180
>>>
>>>
>>> Still...
>>>
>>> 18:13:41.232154 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [S],
>>> seq 3592225170, win 14600, options [mss 1460,sackOK,TS val 160790012 ecr
>>> 0,nop,wscale 7], length 0
>>> 18:13:41.232238 IP 192.168.24.239.88 > 192.168.24.217.42362: Flags [S.],
>>> seq 2526310478, ack 3592225171, win 14480, options [mss 1460,sackOK,TS
>>> val 174749087 ecr 160790012,nop,wscale 7], length 0
>>> 18:13:41.232739 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [.],
>>> ack 1, win 115, options [nop,nop,TS val 160790013 ecr 174749087], length 0
>>> 18:13:41.232787 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [P.],
>>> seq 1:141, ack 1, win 115, options [nop,nop,TS val 160790013 ecr
>>> 174749087], length 140
>>> 18:13:41.232804 IP 192.168.24.239.88 > 192.168.24.217.42362: Flags [.],
>>> ack 141, win 122, options [nop,nop,TS val 174749087 ecr 160790013], length 0
>>> 18:13:41.245137 IP 192.168.24.239.88 > 192.168.24.217.42362: Flags [P.],
>>> seq 1:704, ack 141, win 122, options [nop,nop,TS val 174749090 ecr
>>> 160790013], length 703
>>> 18:13:41.245517 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [.],
>>> ack 704, win 126, options [nop,nop,TS val 160790026 ecr 174749090], length 0
>>> 18:13:41.245578 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [F.],
>>> seq 141, ack 704, win 126, options [nop,nop,TS val 160790026 ecr
>>> 174749090], length 0
>>> 18:13:41.246606 IP 192.168.24.239.88 > 192.168.24.217.42362: Flags [F.],
>>> seq 704, ack 142, win 122, options [nop,nop,TS val 174749090 ecr
>>> 160790026], length 0
>>>
>>>
>>>
>> Your SRV records look correct. We may have a bug here. What
>> "engine-manage-domains" command line are you exactly using? Are you
>> using the "-ldapServers" option?
> Yes,
>
> engine-manage-domains -action=add -domain=elementary.se
> -provider=OpenLDAP -user=ovirt -interactive -ldapServers=ldap.elementary.se
>
Ok. I am most certain now that engine-manage-domains ignores the DNS
query for Kerberos servers when the -ldapServers option is used, in fact
it doesn't run it. That is a bug. As a workaround you can manually fix
the generated krb5.conf file.
To verify that it is actually a bug I would appreciate if you can run
the engine-manage-domains tool and check if it is performing the DNS
query for the Kerberos server (using the DNS server log, or tcpdump). I
think that it won't do it, but need to double check.
Here is the whole communication between the engine and the
nameserver/kdc/ldap-server during the add-domain command. I'd say it
does do the query for the kerberos-server.
18:13:38.037098 IP 192.168.24.217.48417 > 192.168.24.231.53: 1+ SRV?
_kerberos._tcp.elementary.se. (46)
18:13:38.037835 IP 192.168.24.231.53 > 192.168.24.217.48417: 1* 1/2/3
SRV admin.elementary.se.:88 0 0 (169)
18:13:41.230377 IP 192.168.24.217.38038 > 192.168.24.231.53: 2207+ A?
ldap.elementary.se. (36)
18:13:41.230424 IP 192.168.24.217.38038 > 192.168.24.231.53: 58788+
AAAA? ldap.elementary.se. (36)
18:13:41.230716 IP 192.168.24.231.53 > 192.168.24.217.38038: 2207* 1/2/2
A 192.168.24.239 (120)
18:13:41.230834 IP 192.168.24.231.53 > 192.168.24.217.38038: 58788*
0/1/0 (82)
18:13:41.232154 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [S],
seq 3592225170, win 14600, options [mss 1460,sackOK,TS val 160790012 ecr
0,nop,wscale 7], length 0
18:13:41.232238 IP 192.168.24.239.88 > 192.168.24.217.42362: Flags [S.],
seq 2526310478, ack 3592225171, win 14480, options [mss 1460,sackOK,TS
val 174749087 ecr 160790012,nop,wscale 7], length 0
18:13:41.232739 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [.],
ack 1, win 115, options [nop,nop,TS val 160790013 ecr 174749087], length 0
18:13:41.232787 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [P.],
seq 1:141, ack 1, win 115, options [nop,nop,TS val 160790013 ecr
174749087], length 140
18:13:41.232804 IP 192.168.24.239.88 > 192.168.24.217.42362: Flags [.],
ack 141, win 122, options [nop,nop,TS val 174749087 ecr 160790013], length 0
18:13:41.245137 IP 192.168.24.239.88 > 192.168.24.217.42362: Flags [P.],
seq 1:704, ack 141, win 122, options [nop,nop,TS val 174749090 ecr
160790013], length 703
18:13:41.245517 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [.],
ack 704, win 126, options [nop,nop,TS val 160790026 ecr 174749090], length 0
18:13:41.245578 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [F.],
seq 141, ack 704, win 126, options [nop,nop,TS val 160790026 ecr
174749090], length 0
18:13:41.246606 IP 192.168.24.239.88 > 192.168.24.217.42362: Flags [F.],
seq 704, ack 142, win 122, options [nop,nop,TS val 174749090 ecr
160790026], length 0
18:13:41.246949 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [.],
ack 705, win 126, options [nop,nop,TS val 160790028 ecr 174749090], length 0
18:13:41.279159 IP 192.168.24.217.57156 > 192.168.24.239.389: Flags [S],
seq 2210256546, win 14600, options [mss 1460,sackOK,TS val 160790060 ecr
0,nop,wscale 7], length 0
18:13:41.279218 IP 192.168.24.239.389 > 192.168.24.217.57156: Flags
[S.], seq 323087650, ack 2210256547, win 14480, options [mss
1460,sackOK,TS val 174749098 ecr 160790060,nop,wscale 7], length 0
18:13:41.279627 IP 192.168.24.217.57156 > 192.168.24.239.389: Flags [.],
ack 1, win 115, options [nop,nop,TS val 160790060 ecr 174749098], length 0
18:13:41.288761 IP 192.168.24.217.49767 > 192.168.24.231.53: 13267+ PTR?
239.24.168.192.in-addr.arpa. (45)
18:13:41.289162 IP 192.168.24.231.53 > 192.168.24.217.49767: 13267*
1/1/1 PTR ldap.elementary.se. (111)
18:13:41.295950 IP 192.168.24.217.42364 > 192.168.24.239.88: Flags [S],
seq 2256374539, win 14600, options [mss 1460,sackOK,TS val 160790076 ecr
0,nop,wscale 7], length 0
18:13:41.296006 IP 192.168.24.239.88 > 192.168.24.217.42364: Flags [S.],
seq 1178658823, ack 2256374540, win 14480, options [mss 1460,sackOK,TS
val 174749103 ecr 160790076,nop,wscale 7], length 0
18:13:41.296390 IP 192.168.24.217.42364 > 192.168.24.239.88: Flags [.],
ack 1, win 115, options [nop,nop,TS val 160790077 ecr 174749103], length 0
18:13:41.296440 IP 192.168.24.217.42364 > 192.168.24.239.88: Flags [P.],
seq 1:646, ack 1, win 115, options [nop,nop,TS val 160790077 ecr
174749103], length 645
18:13:41.296454 IP 192.168.24.239.88 > 192.168.24.217.42364: Flags [.],
ack 646, win 124, options [nop,nop,TS val 174749103 ecr 160790077], length 0
18:13:41.313368 IP 192.168.24.239.88 > 192.168.24.217.42364: Flags [P.],
seq 1:626, ack 646, win 124, options [nop,nop,TS val 174749107 ecr
160790077], length 625
18:13:41.313749 IP 192.168.24.217.42364 > 192.168.24.239.88: Flags [.],
ack 626, win 124, options [nop,nop,TS val 160790094 ecr 174749107], length 0
18:13:41.313766 IP 192.168.24.217.42364 > 192.168.24.239.88: Flags [F.],
seq 646, ack 626, win 124, options [nop,nop,TS val 160790094 ecr
174749107], length 0
18:13:41.314773 IP 192.168.24.239.88 > 192.168.24.217.42364: Flags [F.],
seq 626, ack 647, win 124, options [nop,nop,TS val 174749107 ecr
160790094], length 0
18:13:41.315070 IP 192.168.24.217.42364 > 192.168.24.239.88: Flags [.],
ack 627, win 124, options [nop,nop,TS val 160790096 ecr 174749107], length 0
18:13:41.374356 IP 192.168.24.217.57156 > 192.168.24.239.389: Flags
[P.], seq 1:621, ack 1, win 115, options [nop,nop,TS val 160790155 ecr
174749098], length 620
18:13:41.374425 IP 192.168.24.239.389 > 192.168.24.217.57156: Flags [.],
ack 621, win 123, options [nop,nop,TS val 174749122 ecr 160790155],
length 0
18:13:41.458769 IP 192.168.24.239.389 > 192.168.24.217.57156: Flags
[P.], seq 1:77, ack 621, win 123, options [nop,nop,TS val 174749143 ecr
160790155], length 76
18:13:41.459284 IP 192.168.24.217.57156 > 192.168.24.239.389: Flags [.],
ack 77, win 115, options [nop,nop,TS val 160790240 ecr 174749143], length 0
18:13:41.462180 IP 192.168.24.217.57156 > 192.168.24.239.389: Flags
[P.], seq 621:677, ack 77, win 115, options [nop,nop,TS val 160790243
ecr 174749143], length 56
18:13:41.462237 IP 192.168.24.239.389 > 192.168.24.217.57156: Flags [.],
ack 677, win 123, options [nop,nop,TS val 174749144 ecr 160790243],
length 0
18:13:41.462855 IP 192.168.24.239.389 > 192.168.24.217.57156: Flags
[P.], seq 77:91, ack 677, win 123, options [nop,nop,TS val 174749144 ecr
160790243], length 14
18:13:41.475422 IP 192.168.24.217.57156 > 192.168.24.239.389: Flags
[F.], seq 677, ack 91, win 115, options [nop,nop,TS val 160790256 ecr
174749144], length 0
18:13:41.477538 IP 192.168.24.239.389 > 192.168.24.217.57156: Flags
[F.], seq 91, ack 678, win 123, options [nop,nop,TS val 174749148 ecr
160790256], length 0
18:13:41.477853 IP 192.168.24.217.57156 > 192.168.24.239.389: Flags [.],
ack 92, win 115, options [nop,nop,TS val 160790258 ecr 174749148], length 0