#OIM STUCK

[glissandolight]

[dadvans]

DEL… that quote from “to have outlived the night” in your tags has fully sent me into a Teen Wolf fic rereading spiral… and I’ve just realized that Objects in Motion is no longer online. do you have a copy of it? I try my best to archive all my favorite fics across fandoms but somehow missed that truly iconic one 😩. thank you for your service slash the IMMENSE nostalgia trip!!

okay, SO, 3 THINGS:

1. fun fact, i was thinking of that post the other day, because i have another sterek fic (outside of THOTN and OIM) that i get stuck in my head on a regular basis. i definitely posted about this years ago, but: literally the final paragraph of In Other Words, Baby, Kiss Me. like damn, i think you have to read the whole goddamn fic for the last sentence to hit, but then the entire fic is worth it for that last sentence.

SPOILER but "i like it," derek says. but he's looking at stiles while they watch the fireworks and it's the first time derek has seen this very thing from an earth perspective, a place where he's never fucking been, and yet he's hooked on stiles like stiles is phonics is like!!!! WHEW BUDDY, I THINK ABOUT IT ALL THE TIME!!! it's almost been a gd decade!!!

2. i do want to post the actual full quote from THOTN that i love so much outside of the tags, because it's been over a decade and it still whammies me straight in the organs like a car crash:

He’s holding up one of the towels Derek hadn’t had the energy to keep track of last night. “I forgot you were born in a barn.”

I was born at home, he thinks. Sixteen hours of labor, and Laura had teased him about being antisocial from the womb. His mother had always called him her shy boy.

3. you bet ur fucking ass i have Objects in Motion by pyes saved. message me on discord (dadvans#0375) and i will send u my copy.

**for those who never experienced it, when i think of Objects in Motion, here is the immediate line that lives in my head:

Scott laughs and holds his glass in their direction, Stiles fills it then toasts him, and he swigs back the champagne straight from the bottle. It’s brilliant and bubbly, he almost gargles it; Lydia looks appalled, and he feels like a million dollars, a million different dollars, all of them all at once.

[molusca]

hi okivernits 3:50am but i just woke up from a dream where you were gone andim fealllg upset right now :( i’m half asleep but i want you to know that i love you and care about you and i can’t imsgine this website without you! i hope we stay friends for a logn time. im glad you’re here. oim gonngo back to bed now goodnight :(

OKIVERNITS ah yes thats my name

ren our kin connection is going too far!!! too far!!! stop dreaming with me and awakening in the middle of the night im gonna fall in love with u!!! jaskgdkjagsdjk babe i love you too dw im stuck here with u!! u will have to deal with me for a long time dont think otherwise >:( 

omg i hope u went back to sleep and had a good night after that... dumbass. go back to sleep <3 *shifts into ur dreams and passionately kisses u*

[doodlebeeberry]

Waitin' For A Minute, Till' The Sun Sees Through My Eyes

in which Bubble adopts a dying rose bush

debut of the alliance! or the rest of them anyway lol

bit of a slow chapter but sometimes thats just how it goes

ch 2/?

AO3

The Yoyle Needle was absolutely massive , standing taller than any other building in the city, making it a good landmark to orient yourself with, particularly when you spent most of your time there anyway. It had seemed a bit intimidating at first, all things considered, but after a while, it simply blended into the background. It became normal.

As it’s base came into view, Bubble spotted her friends clustered on the sidewalk near the door. Ruby and Book sat on the edge in the midst of a heated thumb war, Ice Cube playing referee. Pencil and Match leaned against the wall, spectating. Ice Cube piped up, though what exactly she said was lost on her as Ruby threw her arms up and cheered, seemingly victorious. Match glanced in Bubble’s direction and smiled, waving.

“Hey Bubs!”

Everyone turned towards her as she approached.

“Hoi goirls! Hope I didn’t keep you waiting.”

“Nope,” Ruby chirped, snatching her Shirly temple from the tray. “we just got here!” She plucked the cherry off the top and popped it into her mouth, tossing the stem over her shoulder and into the street as book passed Ice Cube her cherry cola before sipping her own apple juice. Match took both the iced coffee and iced tea, passing the former to Pencil, who gave them both a small smile of thanks before sipping it.

“I still down know how Gelatin learned to make any of this stuff,” Pencil said, looking at the crude drawing of Gelatin on the cup, “I don’t even think I’ve seen him in a kitchen before.”

As much as she liked his drinks, Bubble was equally curious. Back in his steakhouse, she simply assumed there were chefs preparing the meals while he milled about the restaurant talking to customers, but the drink stand he’d opened when they moved put a hole in that theory. Every Wednesday, when it was her turn to get the morning drinks, he would spend several minutes standing by the window chatting with her idly after she’d ordered before turning around for mere seconds and returning with the drinks. She could see straight to the back from where she stood, which was empty with the exception of Gelatin himself, who, when pressed, only ever answered that he was “just that good”.

Taking the remaining strawberry lemonaid and sipping it, she decided, perhaps, that she didn’t want to know. She tossed the empty tray in the nearby bin.

Bubble sipped her lemonaid, halfway through the cup when Ruby piped up

“So, what’re we doing today?”

“Pencil and I are, like, going downtown to look for a camera”

“What do you need a camera for?” Book asked.

Pencil swirled what little coffee was left in her cup

“We’re gonna start a vlog series, ” She replied, “Don’t want our fans to miss us too much.”

“Oh, wow, neat! Ice cube and I are gonna try baking yoyleberry pie again.”

Ice Cube smiled as Book said her name, glancing at her with soft eyes as she drank the last of her soda. Pencil glanced between them, smirking.

“Just don’t, like, make a mess of the kitchen again”

“Oh, come on, it wasn’t that bad.” Book replied.

Match scoffed.

“Like, as if. There was flower everywhere for, like, a week!”

“It was only a day , Match, and—”

Ruby stuck herself between the two, cutting them off before they could jump at each other’s throats

“What about you, Bubble? What’re you up to today?”

Bubble jumped at her name. She hadn’t been focusing on the conversation, finding herself studying the droplets of condensation on her cup run down and land on top of her hand. The sorrowful little rose bush was burned into her mind, a pang of odd guilt chiming in at the thought. Perhaps she shouldn’t have left it behind, she thought, not when it so badly needed help, but—

She shook it off, turning to Ruby.

“Woil, I wointed to do some gardening, but oim not sure…”

“Why not?”

“Oi need to move a plant woith thorns and”— Bubble glanced away—“I dont wonna pop.”

She sipped the last of her lemonaid as Ruby smiled.

“Oh! If thats all, then I can help you out!”

“Roilly? But aren’t you busy?”

“Not really,” Ruby shrugged, “and I like helping you garden anyway!”

Again, Pencil smirked at the two of them as Bubble beamed wide.

Noon had hit by the time Bubble returned to the alleyway, this time with Ruby in tow. Despite the sun’s position the area was still cast in a cool shade by the buildings towering on every side. They stopped just in front of the withered old rose bush, crumpled at their feet. Somehow its seemed even worse for wear then before.

“Yeah, that doesn’t look good,” Ruby said.

Bubble hummed, kneeling down and inspecting a leaf. “It’s not getting enough sunloight over here. Oi wanna move it, but—”

“Say no more!”

Ruby knelt down and reached for the pot, scraping her hands a bit in the process. Pale brown roots caught Bubble’s eye as she began hefting the plant into the air. They stretched between the sidewalk and the pot.

“Roiby wait! Your gonna break the roots!”

She paused. A sprinkle of soil fell from the pot and into the large crack in the ground the roots had dug themselves into.

“Oh. Sorry.”

“Its ok.”

Ruby returned the pot to its place over the hole.

“So what do we do now?”

“Hmmm, well”—Bubble stood up, Ruby following suit—“if we had a shovel, oi could try digging them up.”

“But I thought you hadn’t brought all your gardening stuff here yet?”

Turning back, Bubble peered around the corner, scanning the abandoned buildings carefully. A restaurant, a shipping outpost, a toy store stood across the street, flanked on the left by a pharmacy and on the right by a—

“Oh! That plant shop moight have some!”

[yohandere]

so heres how that train ride went now that oim home andnot frozen numb

got on per normal then this dude comes stumbling in loudly and drops his bike on the floor of the train and like yelled epxletives then sat at the chairs like across from me, then he like asked me to take my headphones out and he started talking to me with a weird speech impediment and telling me that he just got out of the mental hospital and i was like oh im sorry to hear that etc being friendly then he was like ha i got you you totally fell for it and like he was faking the speech impediment etc he was really gross looking probably in his 70s annd had a bottle of vodka on him and his teeth were mising etc then he was like haha got you and then sat next to me and put his bike and snow shovel across like, where i could leave so i was stuck sitting on the seat with him and he kept grabbing my hand and shit and trying to touch my leg and i was trying to be confident and friendly so i didnt come across as like easily preyed upon then he was like complimenting me and started barking at me and laughing etc and then i was like hahjdfjh okay well *selects Lie bullet from drv3* this is my train stop so i gotta go , so i pushed him away and ran off then i had to wait 10 mins in the cold and snow with no jacket on. and i feel gross so i came back and i cried into my mom lol.

shes really mad at my dad like super mad bc he really made this whole day about him and his work etc and i like feel selfish for wanting him and my grandparents to like ask me more about my moving and everything but it was like barely discussed since we were at my dads work and he gave us a tour or whatever idk it sucked and now im tired and i feel like shit and  i feel selfish as fuck so thats that

[ssnlinux]

Things I’ve Learned: FreeIPA

I've been a user of FreeIPA for quite a long time, mostly in home and lab environments that didn't really have any bearing on enterprise environments. I always saw it as a sort of Active Directory (it's not) for Linux and UNIX systems and used it to test various things. One example of using it to test "things" was practicing for my RHCE in 2016 and also studying my Red Hat Security Hardening. Now I've used it since version 3.0, and it definitely has come a long way since then. I never really took a lot of the time I thought was necessary to learn specific things about it, in terms of having it work with an Active Directory and even 2FA/OTP among other things. Many years ago, there were functions such as winsync (which is now deprecated) that helped with this, while even the sssd components began to slowly integrate Active Directory support directly.

To give some backstory to the title of this post: In my current job, we are a mixed environment shop. We have a handful of Windows, Linux, and UNIX systems. Because of this, we have two separate directory servers. We have an LDAP and an Active Directory. A few years back, I respawned conversations that were shut down by previous management: We need to consolidate directory servers into at least Active Directory. Practically all of our workstations run Windows or Mac. Our usernames between both directories are different (LDAP uses underscores between first and last names, AD had first initial, last name up to 7 characters and now it's first.last). You can imagine how confusing this is and how annoying this actually is.

You can imagine the challenges this brings. In fact, here's a list of challenges this poses for the organization.

New users get confused and think they login with user.name@domain, domain\user.name, user.name on Linux/UNIX systems

Users at times do not know what username is used for what application or system (is it user_name or user.name for $x?)

Introduction of OIM (oracle identity manager) and OAM (oracle access manager), which was setup incorrectly and managed poorly by incompetent team called "information security"

Now you might wonder why does this matter to my FreeIPA topic. Simple, it causes issues for the UNIX engineering team (which I now co-lead).

Managers and above as well as new users expect all their access to be already there for all Linux/UNIX systems they need to work on

Again, new users get confused and use AD usernames to login to Linux/UNIX systems

Access is defined on their LDAP objects as "host: hostname"

SUDO is hybrid: LDAP and /etc/sudoers.d files

Identity management tools, which have been in the environment for almost 4 years, were never designed to handle the above

Management is reluctant to go to "member" groups to define access to systems (to emulate "role based" access)

This is where I stepped in and suggested that we need to use a different product, even though I initially suggested we go to AD entirely. The problem with going to AD entirely is that it takes away the UNIX team's management, and plus we would probably need to buy other products or software just to get group policies to work. This did not sit well with majority of my team and I didn't like the idea either, especially because we then begin to lose a sense of control on our own systems. This is when I suggested FreeIPA, as FreeIPA at the time (version 4.4) supported IPA-AD trusts. This meant that it gave control back to the UNIX team to our own infrastructure. Logins would be from our AD, we wouldn't need to create accounts in FreeIPA. This reduces a lot of overhead on us, leaving LDAP to start to (hopefully) die off. My team as a whole agreed to the idea so I took the project and started it up.

This is what I've learned and achieved.

The Setup

The setup was easy for me. The network team delegated me a subdomain of one of our internal domains to make my life easier. The Windows team was also extremely helpful and helped me get the AD trust up. I didn't expect it to be a pain, as my tests at home succeeded. The trust was setup, enabling compat and posix attributes (uidNumber, gidNumber, unixHomedirectory, loginShell) to try and make the migration from LDAP to IPA easier. The Windows engineer also setup my team as well as two other teams with the attributes so I had a biggger test bed.

After doing this, I also set the domain resolution order (FreeIPA 4.5) to be the AD domain first. That way, logging in with just user.name without the @domain works without much an issue. And then, clients using sssd had full_name_format set to %1$s to make it less confusing for users on their prompts. I didn't like the idea of having a prompt like user.name@domain.tld@servername - that's extremely annoying to look at. When this is set, you are able to do id for users in both AD or IPA without the domain on the name and it succeeds on RHEL 7 and higher. Setting domain resolution order back to blank or not setting it at all will require the @domain to be used for logins, including in the compat tree. There's really no other clear way around this as far as I know.

SID Numbers

The issue with trying to do a cleanish migration is that you can't change gid numbers out from under people. FreeIPA creates a range for your domain and also creates a range for AD, even if you don't use it/you're using posix attributes. When you create groups outside of IPA's defaulted range, they will not receive SID numbers. In this case, I had to create another range and then rerun the proper SID generating scripts.

I created a range with this data:

Base ID: 10

Range size: 50000

Primary RID base: 200000000

Secondary RID base: 200050000

I then did an update across the board. This took a little bit.

# cat > /root/task/80-sidgen-task-conf.uipdate <<EOF dn: cn=$TIME-$FQDN,cn=ipa-sidgen-task,cn=tasks,cn=config add:objectClass: top add:objectClass: extensibleObject add:cn:$TIME-$FQDN add:nsslapd-basedn: $SUFFIX add:delay: 0 EOF # ipa-ldap-updater /root/task/80-sidgen-task-conf.update

SUDO

SUDO for clients older than RHEL 7 was very interesting when in a IPA-AD trust.

Legacy Clients

Our environment is ridiculously mixed. We have Solaris 8, 10, 11, RHEL 5, 6, and 7. We also have Fedora workstations that my team uses because we dislike Windows, but that's a different story. We have still been trying to get rid of Solaris 8 forever now, but without any movement. We decided to not attach Solaris 8 to FreeIPA to hopefully let the systems rot.

RHEL 5

"RHEL 5???" you might be thinking. Yes. It's been out of support since March 31, 2017. This company has no concept of anything "new" or wanting to get rid of technology debt. So since we were probably going to be stuck with RHEL 5 for another year or so, I had to figure out how to get it to connect to FreeIPA - not only as a client but also be able to see Active Directory users. The first thing I learned here: Always use the ipa-advise command - Seriously. This will help you out so much.

In my case, I used nss pam ldap to help here. What this provided at the very least is the ability to get sudo to actually work 100% of the time - sudo didn't work all the time when sssd was the id provider. Here's the issue:

The domain resolution order configuration causes multiple uid attributes to appear on objects in the compat tree - this is normal.

Group membership, even in the compat tree, is defined by user@domain.tld, rather than just user. As far as I know, there's no clear way around this. Running groups or id will not show proper membership.

sudo probably only worked here because of the id output, even though I was logging in with first.last, my id shows up as first.last@domain.tld and associated that properly with my group membership

When using sssd, while the user would appear as first.last, group membership would never be applied. Here's what I mean.

dn: uid=first.last,cn=users,cn=compat,dc=ipa,dc=example,dc=com cn: First Last objectClass: posixAccount objectClass: top gidNumber: 1006800013 gecos: First Last uidNumber: 10000 loginShell: /bin/bash homeDirectory: /home/first.last uid: first.last@domain.tld uid: first.last dn: cn=unixadm,cn=groups,cn=compat,dc=ipa,dc=example,dc=com gidNumber: 5900 objectClass: posixGroup objectClass: ipaOverrideTarget objectClass: ipaexternalgroup objectClass: top ipaAnchorUUID:: removed cn: unixadm memberUid: first.last@domain.tld

I'm sure you see the problem. This causes other issues: If you're trying to use pam_hbac, it seems to want to work using pam_sss in the stack, not pam_ldap. With pam_ldap, it doesn't even try. With pam_sss, it tries, but it ultimately fails because it doesn't seem to be properly evaluating the rules and groups - again, this goes back to what I said: group membership is not seen with sssd fully while nss pam ldap can associate it to an extent.

As of this writing, I was never able to properly figure this out. What I noticed is in sssd, the group memberships were always intermittent. In fact, it always acted weird - if I did getent group unixadm, it'd show me. As soon as I ran id against my user, I'd disappear from the group. And I found this to be very troublesome. Sometimes it worked, other times it didn't. I could never really figure out why this was happening. One thing I did try was updating SSSD to 1.9.6 from a COPR repo. That didn't help.

Long story short: get rid of your RHEL 5 systems. At least RHEL 6 worked. Sort of.

Solaris 10

Alright, so this is where it gets interesting. Getting it to work with FreeIPA was a chore, a serious chore. The worst part about all of this is the communication from the system to FreeIPA is unencrypted. Yes, you heard this right. Unencrypted. I couldn't even get it to be OK with Kerberos login to at least have a secure channel. The saving grace here is that if you have a keytab on your system and login, it should just work. The other problem I had is I needed to use pam_ldap in my pam configuration.

First thing I needed is a profile that the ldapclient could use. I also created a solaris system account. Here's an example ldif below you can add into IPA.

dn: cn=solaris_authpam,ou=profile,dc=ipa,dc=example,dc=com serviceAuthenticationMethod: pam_ldap:simple authenticationMethod: simple objectClass: top objectClass: DUAConfigProfile bindTimeLimit: 5 cn: default cn: solaris_authpam defaultSearchBase: dc=ipa,dc=example,dc=com defaultServerList: pentl01.ipa.example.com pentl02.ipa.example.com followReferrals: TRUE objectclassMap: shadow:shadowAccount=posixAccount objectclassMap: passwd:posixAccount=posixaccount objectclassMap: group:posixGroup=posixgroup profileTTL: 6000 searchTimeLimit: 15 serviceSearchDescriptor: group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com serviceSearchDescriptor: passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com serviceSearchDescriptor: netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com serviceSearchDescriptor: ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com serviceSearchDescriptor: sudoers:ou=sudoers,dc=ipa,dc=example,dc=com dn: uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com objectClass: account objectClass: simpleSecurityObject objectClass: top uid: solaris userPassword: secret123

I needed to create a keytab for the host.

# ipa host-add hostname.example.com # ipa-getkeytab -s pentl01.ipa.example.com -p host/hostname.example.com@IPA.EXAMPLE.COM -k /tmp/hostname.keytab

I then transferred the keytab to the system and put it at /etc/krb5/krb5.keytab. I configured /etc/krb5/krb5.conf.

[libdefaults] default_realm = IPA.EXAMPLE.COM dns_lookup_kdc = true verify_ap_req_nofail = false [realms] IPA.EXAMPLE.COM = { } DOMAIN.TLD = { } [domain_realm] ipa.example.com = IPA.EXAMPLE.COM .ipa.example.com = IPA.EXAMPLE.COM domain.tld = DOMAIN.TLD .domain.tld = DOMAIN.TLD [logging] default = FILE:/var/krb5/kdc.log kdc = FILE:/var/krb5/kdc.log kdc_rotate = { period = 1d version = 10 } [appdefaults] kinit = { renewable = true forwardable= true }

Set the permissions of the keytab to 600, owned by root:sys. Once it was configured, I tested kinit admin@IPA.EXAMPLE.COM. If you get a message about "kt warn", it can be ignored. After this, set /etc/defaultdomain to your ipa domain (ipa.example.com). Configure /etc/ldap.conf.

base dc=ipa,dc=example,dc=com scope sub TLS_CACERTDIR /var/ldap TLS_CERT /var/ldap/cert8.db TLS_CACERT /var/ldap/ipa.pem tls_checkpeer no ssl off bind_timelimit 120 timelimit 120 uri ldap://pentl01.ipa.example.com sudoers_base ou=sudoers,dc=ipa,dc=example,dc=com pam_lookup_policy yes

Create /var/ldap if needed and create an NSS certificate database. You should also have your CA certificate as /var/ldap/ipa.pem.

# cd /var/ldap # /usr/sfw/bin/certutil -A -n "ca-cert" -i /var/ldap/ipa.pem -a -t CT -d .

At this point, I do the ldapclient init.

# ldapclient init -a profileName=solaris_authpam \ -a domainName=ipa.example.com \ -a proxyDN="uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com" \ -a proxyPassword="secret123" \ -D uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com \ -w qdbKnW1et pentl01.ipa.example.com

Now configure /etc/nsswitch.conf.

passwd: files ldap [NOTFOUND=return] group: files ldap [NOTFOUND=return] sudoers: files ldap netgroup: ldap

Now configure /etc/pam.conf

# Console login auth requisite pam_authtok_get.so.1 login auth sufficient pam_krb5.so.1 login auth required pam_dhkeys.so.1 login auth required pam_unix_cred.so.1 login auth required pam_dial_auth.so.1 login auth required pam_unix_auth.so.1 use_first_pass login auth required pam_ldap.so.1 rlogin auth sufficient pam_rhosts_auth.so.1 rlogin auth requisite pam_authtok_get.so.1 rlogin auth sufficient pam_krb5.so.1 rlogin auth required pam_dhkeys.so.1 rlogin auth required pam_unix_cred.so.1 rlogin auth required pam_unix_auth.so.1 rlogin auth required pam_ldap.so.1 # Needed for krb krlogin auth required pam_unix_cred.so.1 krlogin auth sufficient pam_krb5.so.1 # Remote Shell rsh auth sufficient pam_rhosts_auth.so.1 rsh auth required pam_unix_cred.so.1 rsh auth binding pam_unix_auth.so.1 server_policy rsh auth required pam_ldap.so.1 # Needed for krb krsh auth required pam_unix_cred.so.1 krsh auth required pam_krb5.so.1 # ? ppp auth requisite pam_authtok_get.so.1 ppp auth required pam_dhkeys.so.1 ppp auth required pam_dial_auth.so.1 ppp auth binding pam_unix_auth.so.1 server_policy ppp auth required pam_ldap.so.1 # Other, used by sshd and "others" as a fallback other auth requisite pam_authtok_get.so.1 other auth sufficient pam_krb5.so.1 other auth required pam_dhkeys.so.1 other auth required pam_unix_cred.so.1 other auth binding pam_unix_auth.so.1 server_policy other auth required pam_ldap.so.1 other account requisite pam_roles.so.1 other account required pam_projects.so.1 other account binding pam_unix_account.so.1 server_policy other account required pam_ldap.so.1 other session required pam_unix_session.so.1 other password required pam_dhkeys.so.1 other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 other password required pam_authtok_store.so.1 server_policy # passwd and cron passwd auth binding pam_passwd_auth.so.1 server_policy passwd auth required pam_ldap.so.1 cron account required pam_unix_account.so.1 # SSH Pubkey - Needed for openldap and still probably needed for ipa # without this, ssh keys stopped working. sshd-pubkey account required pam_unix_account.so.1

I installed pkgutil from OpenCSW. Seriously, this will help you out tremendously.

# /opt/csw/bin/pkgutil -y -i sudo sudo_ldap # vi /etc/opt/csw/sudo.conf Plugin sudoers_policy sudoers-ldap.so Plugin sudoers_io sudoers-ldap.so # ln -s /etc/ldap.conf /etc/opt/csw/ldap.conf

After that, I went ahead and tested id, logins, etc.

bash-3.2# id louis.abel uid=25439(louis.abel@domain.tld) gid=1006800013(aocusers)

The current problem is that id won't show group membership, yet if you run the groups command, it will. Just because it shows the groups, doesn't mean you can really work with the files that are group owned as such. This only changes if you login via username@domain.tld.

Solaris 11

Solaris 11 was a lot more forgiving. I was able to get SSL to work and the sudo that they provide to work also. Most of the things above can be used. I'll point out which ones you can pull from above.

Create another profile on the IPA server.

dn: cn=solaris_authssl,ou=profile,dc=ipa,dc=example,dc=com authenticationMethod: tls:simple objectClass: top objectClass: DUAConfigProfile bindTimeLimit: 5 cn: default cn: solaris_authssl defaultSearchBase: dc=ipa,dc=example,dc=com defaultServerList: pentl01.ipa.example.com pentl02.ipa.example.com followReferrals: TRUE objectclassMap: shadow:shadowAccount=posixAccount objectclassMap: passwd:posixAccount=posixaccount objectclassMap: group:posixGroup=posixgroup searchTimeLimit: 15 serviceSearchDescriptor: group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com serviceSearchDescriptor: passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com serviceSearchDescriptor: netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com serviceSearchDescriptor: ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com serviceSearchDescriptor: sudoers:ou=sudoers,dc=ipa,dc=example,dc=com profileTTL: 6000

Generate your keytabs and move them to the server.

Configure the krb5.conf file as necessary.

Set /etc/defaultdomain to your IPA domain.

Place IPA cacert into /var/ldap/ipa.pem

Your /etc/ldap.conf will need to be a tad different on Solaris 11. You will need to remove the TLS_CERT line. Solaris 11 no longer uses NSS.

base dc=ipa,dc=example,dc=com scope sub TLS_CACERTDIR /var/ldap TLS_CACERT /var/ldap/ipa.pem tls_checkpeer no ssl off bind_timelimit 120 timelimit 120 uri ldap://pentl01.ipa.example.com sudoers_base ou=sudoers,dc=ipa,dc=example,dc=com pam_lookup_policy yes

To configure nsswitch, you have to run commands (thanks oracle).

/usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/default = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/sudoer = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/password = astring: "files ldap [NOTFOUND=return]"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/group = astring: "files ldap [NOTFOUND=return]"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/host = astring: "files dns"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/network = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/protocol = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/rpc = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/ether = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/netmask = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/bootparam = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/publickey = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/netgroup = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/automount = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/alias = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/printer = astring: "user files"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/service = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/project = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/auth_attr = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/prof_attr = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/tnrhtp = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/tnrhdb = astring: "files ldap"' /usr/sbin/svcadm refresh svc:/system/name-service/switch ; /usr/sbin/svcadm restart svc:/system/name-service/switch ; /usr/sbin/svcadm restart ldap/client

Now you need to setup all of your pam files. Here are the ones I configured and it worked.

# /etc/pam.d/krlogin auth required pam_unix_cred.so.1 auth required pam_krb5.so.1 # /etc/pam.d/krsh auth required pam_unix_cred.so.1 auth required pam_krb5.so.1 # /etc/pam.d/login auth requisite pam_authtok_get.so.1 auth sufficient pam_krb5.so.1 auth required pam_dhkeys.so.1 auth required pam_unix_cred.so.1 auth required pam_dial_auth.so.1 auth required pam_unix_auth.so.1 server_policy auth required pam_ldap.so.1 # /etc/pam.d/other auth definitive pam_user_policy.so.1 auth requisite pam_authtok_get.so.1 auth sufficient pam_krb5.so.1 auth required pam_dhkeys.so.1 auth required pam_unix_cred.so.1 auth required pam_unix_auth.so.1 server_policy auth required pam_ldap.so.1 account requisite pam_roles.so.1 account definitive pam_user_policy.so.1 account required pam_unix_account.so.1 server_policy account required pam_krb5.so.1 account required pam_tsol_account.so.1 account required pam_ldap.so.1 session definitive pam_user_policy.so.1 session required pam_unix_session.so.1 password definitive pam_user_policy.so.1 password include pam_authtok_common password sufficient pam_krb5.so.1 password required pam_authtok_store.so.1 server_policy # /etc/pam.d/passwd auth binding pam_passwd_auth.so.1 server_policy auth required pam_ldap.so.1 account requisite pam_roles.so.1 account definitive pam_user_policy.so.1 account required pam_unix_account.so.1 # /etc/pam.d/ppp auth requisite pam_authtok_get.so.1 auth required pam_dhkeys.so.1 auth required pam_unix_cred.so.1 auth required pam_dial_auth.so.1 auth required pam_unix_auth.so.1 server_policy auth required pam_ldap.so.1 # /etc/pam.d/rlogin auth definitive pam_user_policy.so.1 auth sufficient pam_rhosts_auth.so.1 auth requisite pam_authtok_get.so.1 auth sufficient pam_krb5.so.1 auth required pam_dhkeys.so.1 auth required pam_unix_cred.so.1 auth required pam_unix_auth.so.1 auth required pam_ldap.so.1 # /etc/pam.d/rsh auth definitive pam_user_policy.so.1 auth sufficient pam_rhosts_auth.so.1 auth required pam_unix_cred.so.1 auth required pam_ldap.so.1 # /etc/pam.d/sshd-pubkey account required pam_unix_account.so.1

The only issue is if you are using domain resolution order, trying to login without the realm name for AD users will cause an assertion error. I asked Oracle to fix this because Solaris 10 was fine. I don't know when they'll fix it. As of this writing, they claim October 20, 2017.

The actual current problem is that id won't show group membership, yet if you run the groups command, it will. Just because it shows the groups, doesn't mean you can really work with the files that are group owned as such. This only changes if you login via username@domain.tld or remove the domain resolution order entirely - this would cause you to have to login with username@domain.

HBAC

For legacy clients to authenticate AD users properly, you need an HBAC rule against the IPA servers that perform the task of talking to AD. I'd recommend creating an ipaservers group (if one doesn't exist already) of all of your IPA servers, and then creating the hbac rules.

# ipa hbacsvc-add system-auth # ipa hbacrule-add system-auth-legacy # ipa hbacrule-add-host --hostgroup=ipaservers # ipa hbacrule-mod --usercat=all system-auth-legacy

For legacy clients, you need the pam_hbac module. For RHEL 5, there is a copr repo that you can pull the RPM's for. For Solaris, you are required to compile them, which isn't fun, I understand. Below I'll show you how to compile the modules and how to utilize the module.

Solaris 10 ++++++++++

You need to install OpenCSW's pkgutil. I also brought the sources of pam_hbac from github over as a git clone in a tar file.

root# pkgutil -y -i libglib2_dev gmake openssl binutils gcc4g++ glib2 ar libnet root# cd /tmp root# tar xf pam_hbac.tar root# cd /tmp/pam_hbac root# PATH=$PATH:/opt/csw/bin root# autoconf -o configure ; autoreconf -i root# ./configure AR=/opt/csw/bin/gar --with-pammoddir=/usr/lib/security --sysconfdir=/etc/ --disable-ssl root# vi Makefile.am ## Comment out the man pages #if HAVE_MANPAGES #SUBDIRS += doc #endif root# make root# make install root# /etc/pam_hbac.conf URI = ldap://pentl01.ipa.example.com BASE = dc=ipa,dc=example,dc=com BIND_DN = uid=hbac,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com BIND_PW = secret123 SSL_PATH = /var/ldap HOST_NAME = hostname.example.com

After this, you can place the hbac lines in your pam file. I usually put it under 'other' and 'login' as "account".

login auth requisite pam_authtok_get.so.1 login auth sufficient pam_krb5.so.1 login auth required pam_dhkeys.so.1 login auth required pam_unix_cred.so.1 login auth required pam_dial_auth.so.1 login auth required pam_unix_auth.so.1 use_first_pass login auth required pam_ldap.so.1 login account required pam_hbac.so ignore_unknown_user ignore_authinfo_unavail debug # other account requisite pam_roles.so.1 other account required pam_projects.so.1 other account binding pam_unix_account.so.1 server_policy other account required pam_ldap.so.1 other account required pam_hbac.so ignore_unknown_user ignore_authinfo_unavail debug

To answer your question, yes. I had to disable SSL. This is because IPA has a lot of ciphers turned off. Solaris 10 doesn't support much higher, and because these are dynamically compiled (not static), they pick up both SSL libraries from OpenCSW and the system. But the system is picked up first and used.

Solaris 11 ++++++++++

Compiling on Solaris 11 is easier (thankfully).

root# pkg install autoconf libtool pkg-config automake gcc asciidoc docbook (some of these won't install, that's fine) root# cd /tmp root# tar xf pam_hbac.tar root# cd /tmp/pam_hbac root# autoreconf -if root# ./configure --with-pammoddir=/usr/lib/security --mandir=/usr/share/man --sysconfdir=/etc/ root# make root# make install root# /etc/pam_hbac.conf URI = ldap://pentl01.ipa.example.com BASE = dc=ipa,dc=example,dc=com BIND_DN = uid=hbac,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com BIND_PW = secret123 SSL_PATH = /var/ldap HOST_NAME = hostname.example.com

Pam is a little different here. I configured login and other just like on Solaris 10.

# goes at the VERY end of the account block in /etc/pam.d/other and /etc/pam.d/login account required pam_hbac.so ignore_unknown_user ignore_authinfo_unavail debug

General +++++++

You also need to create an hbac service in IPA.

# ipa hbacsvc-add sshd-gssapi # ipa hbacsvc-add sshd-kbdint

You would need to associate those in particular to your HBAC rule sets as needed for your legacy hosts.

Summary

What I've learned overall is that trying to get legacy clients to work with FreeIPA is actually simple if you were only using IPA. It begins to get tricky when you add in AD. The other thing I've learned is that there are companies that will not let go of their dying systems and we just have to live with it. Because this is the case and I know it will not change any time soon, I had to really put a lot of (unnecessary) effort into making this all work. RHEL 6 and RHEL 7? Easy. RHEL 5, Solaris 10/11? Not so easy.

This also gave me a more of a sour taste in my mouth about the political landscape of an enterprise. It's just flat out unfortunate. But, I am glad I got this experience so I can show others what I had to deal with and hopefully others can conquer it in the same way or even better than I have.

[letpapersleep]

well u sure went all out Purple: 10 facts about my room i have a bunch of random things stuck to the wall above my bed ive had both an ant problem & a flea problem there and it sucked both times i share it w/ my little brother i prefer sleeping on my couch 2 sleeping in my bed it feels less official its got 1 big window that faces the street light outside our house & i die its got all my fuckin stuff in it usually messy its got those stupid evil closet doors... fello house renters u know cup city no food allowed in it Blue: 9 facts about my family my mom & dad r divorced my dad and my aunt & uncle have a connected house & it fucking rocks everyone on my dads side of the family is incapable of making plans more than a day in advance my moms the best! my granma on my moms side lives in Belize oim some part finnish on my moms side i have a little brother who's 8 my godmother lives in the apartment above my mom & they're best friends my coffee love comes from my mom lmao Green: 8 facts about my body i have glasses my hair is dyed blue i usually have nail polish on i have high arches & they make most shoes very evil 2 wear built for cuddling cats i have green eyes i have p long eyelashes Yellow: 7 facts about my childhood i only watched like 3 movies i loved reading & i was a huge bookworm i had a dog names Asheema and we were bffs i was a Very nosy kid i talked with my friends over email i have v nice memories of visiting places w/ my moms family as a kid :) i lived across the street from my elementary school & still managed to be late avid trampoline bouncer, very avid Orange: 6 facts about my home town its motto is "beer city" its definitely a tourist town but not as sever as a beach town its very beautiful! distinct blend of hippies, hipsters and hicks this winter we had so many wildfires & the air was smoggy for abt a month our river is like a tourist attraction but its so,,, dirty,,, Red: 5 facts about my best friend very talented @ art!!!! has a great sense of humor probably has a piss kink or a sans kink avid furry accuser has a cola addiction Pink: 4 facts about my parents my dads a musician hes made an album my mom is a florist so im always very suspicious of florists AU's because they usually get so much off i watch greys anatomy w/ my mom heheh ive had my dad dab & nya before and both times i Died White: 3 facts about my personality if u don't find me funny ur going to find me very grating aha im kinda quiet around strangers but i warm up to ppl real fast im a nap person in theory Grey: 2 facts about my favorite things when cats lie on u and they r rumbly blankets very blue natural lighting is the Shitt! Black: 1 fact about the person I like 1-they dont fucking exist

[noloveforned]

a little advance warning again this week that we'll be on wlur in a few hours. catch up with last week's show below and then tune in!

no love for ned on wlur – october 11th, 2017 from 5-7pm

artist // track // album // label bikeride // wave // thirty-seven secrets i only told america // hidden agenda crepes // mild conversation // channel four // spunk today's hits // you are what you eat // lay up cassette // headdress weedhounds // oxalis // double life cassette // don giovanni wurld series // rabbit // air goofy cassette // melted ice cream the replacements // left of the dial // for sale: live at maxwell's 1986 // rhino orb // you are right // naturality // castle face * patsy // society ape // la women ep // la vida es un mus discos terry malts // off my back // split ep w/ kids on a crime spree // emotional response holiday ghosts // airwaves // holiday ghosts // pnkslm * wayne stewart // if you could be him instead // transparent days- west coast nuggets compilation // rhino acid baby jesus // down the ley lines // lilac days // fuzz club alvarius b. // dark in my heart // with a beaker on the burner and an otter in the oven // abduction jessica lea mayfield // safe to connect to // sorry is gone // ato * mapache // broken down cadillac // mapache // spiritual pajamas simon joyner // atlanta bypass // step into the earthquake // shrimper elkhorn // sugar hill raga // the black river // debacle sarah louise // rime // for the benefit of love // (self-released) david grubbs // jeremiadaic // creep mission // blue chopsticks cecil taylor // lena // nefertiti, the beautiful one has come // revenant thelonius monk // well, you needn't // les liaisons dangereuses, 1960 // saga akalé wubé // kulunmangqueleshi // ethiopian groove greatest hits // 2009 // (self-released) the commands // a way to love me // on duty with... // numero group oma heard // stuck-up // motown unreleased 1965 compilation // motown damaged bug // bunker funk // bunker funk // castle face jamila woods featuring lorine chia // lonely // heavn // jagjaguwar * kommode // fight or flight or dance all night // analog dance music // brilliance shout out louds // angel // ease my mind // merge * alex macfarlane // every phone is ringing for me // 2017 cassette // hobbies galore the orchids // apologies // who needs tomorrow- a thirty year retrospective // 1988 // cherry red the fireworks // better without you now (acoustic) // march, april and may mix #2 compilation // february rose melberg and larissa loyva // dues // september (outtake) // lost sound tapes everyone is dirty // journeyman plumber // my neon's dead // oim * andy shauf // the worst in you // the party // anti-

* denotes music on wlur’s playlist