When (re-)joining an EL7 system to the AD domain, something somewhere issues a dynamic dns update for $FQDN. How can I suppress that?

The sssd.conf itself is pre-populated with

[domain/ad.example.com]
dyndns_update = false
dnydns_iface = eno1, eth0, otherpossibleprimarynicnames

I do not suffer from wanton dynamic dns updates during regular operations. But when re-joining the AD domain, all the ethernet cards' IP addresses magically show up in dns, which then causes havoc.

On EL6, I use the net ads join which has a nice option: --no-dns-updates but I see no equivalent option for the realm command.

If no options come up, I might just fall back to net ads join on EL7 and discard the "new and improved" realmd.

tl;dr

How can I allow a normal user to read one systemd service's logs?

Long question

Environment: CentOS 7

A user needs access to his service's logs, which are by default consumed by journald. I can view them as my non-root user (because I'm in the wheel group), but the other user cannot. He will not get membership in wheel, but he needs his logs.

What permissions do I need to give him, so he can get to the logs? I would appreciate if he could run a standard journalctl command, like maybe

journalctl -f -u servicename.service

I guess if I have to, I can configure the service file specifically to log to a file, right? I guess I can have the ExecStart include a | /usr/bin/tee -a /var/log/servicename.log but why can't systemd handle this better?

tldr: How can I get iptables to show just one chain?

I can have iptables show just one table, but a table consists of multiple chains. I need to find where in chain INPUT is the last rule (usually but not always the REJECT all rule).

I've tried awk and even some grep, but my skill in those must be waning. I've tried using awk to get just one paragraph, but that doesn't seem to work on the output of iptables --line-numbers -n -L -t filter maybe because those blank lines aren't really blank.

I am looking for a solution with any normal gnu tools that would be installed on a CentOS 6 minimal environment.

TL;DR

SELinux is blocking samba from reading /var/log and all contents

Problem

With SELinux disabled, my samba users (sssd/kerberos joined to AD 2008 R2) can browse my shared directory /var/log. With SELinux enabled, it doesn't work.

My /var/log/messages snippet

Aug 29 13:28:38 servername kernel: [11625.509586] type=1400 audit(1472491718.859:35): avc:  denied  { read } for  pid=7492 comm="smbd" name="spamfilter-all.log" dev="dm-3" ino=26 scontext=system_u:system_r:smbd_t:s0 tcontext=unconfined_u:object_r:var_log_t:s0 tclass=lnk_file
Aug 29 13:28:38 servername kernel: [11625.626225] type=1400 audit(1472491718.975:36): avc:  denied  { getattr } for  pid=7492 comm="smbd" path="/var/log/remote/192.168.11.1" dev="dm-3" ino=1966096 scontext=system_u:system_r:smbd_t:s0 tcontext=unconfined_u:object_r:var_log_t:s0 tclass=lnk_file

Running audit2allow < ~/logsnippet shows

#============= smbd_t ==============

#!!!! This avc can be allowed using one of the these booleans:
#     samba_export_all_ro, samba_export_all_rw
allow smbd_t var_log_t:lnk_file { read getattr };

What I've already tried

From https://wiki.centos.org/HowTos/SELinux, I tried using audit2allow to make a module that I then loaded:

audit2allow < ~/logsnippet -M allow_samba_var_log
semodule -i allow_samba_var_log.pp

The module installed, because I see it in semodule -l | grep allow but I still cannot access /var/log through samba.

What I cannot do

• Disable SELinux
• https://lists.samba.org/archive/samba/2006-May/120632.html suggests modifying source, but I am not certain I want to try to modify source code for an selinux package (selinux-policy-targeted-sources is named in this link). Someone might be able to convince me to do this if necessary.

End results

What I ended up doing was enabling the boolean samba_export_all_ro.

TL;DR

I want to be able to ssh from a FreeBSD host to a FreeBSD host, using my kerberos ticket generated when I first logged in.

Question

Environment

FreeBSD 10.3 with working openldap-sasl-client, kerberos 5 (not heimdal), sssd, ssh, and joined to Active Directory (2008 R2). I had to compile sssd from the /usr/ports source location because by default sssd-ad is not included which I need. I'm not using winbind, so reference 1 is not helpful. (Nor does FreeBSD have an authconfig command, apparently.) I can perform a kinit just fine:

[bgstack15@localhost /]$ kinit
[email protected]'s Password:
[bgstack15@localhost /]$ klist
Credentials cache: FILE:/tmp/krb5cc_5532829429
        Principal: [email protected]

  Issued                Expires               Principal
Aug 18 16:01:16 2016  Aug 19 02:01:16 2016  krbtgt/[email protected]

After that I can ssh -K secondhost and it takes me right there.

The issue is I want to be able to generate a Kerberos ticket upon logging in, or at least so I don't have to enter my password in, at all. I used GSSAPI auth to get to localhost, so I got in with a kerberos ticket. Can I pass that one along, perhaps?

What I've already tried

Here's my /etc/pam.d/sshd

auth            sufficient      pam_opie.so             no_warn no_fake_prompts
auth            requisite       pam_opieaccess.so       no_warn allow_local
auth            sufficient      pam_unix.so             no_warn
auth            sufficient      pam_krb5.so             no_warn use_first_pass forwardable ccache=krb5cc_%u
auth            required        pam_unix.so             no_warn try_first_pass

account         required        pam_nologin.so
account         required        pam_login_access.so
account         sufficient      /usr/local/lib/pam_sss.so       ignore_unknown_user
account         required        pam_unix.so

session         optional /usr/local/lib/pam_sss.so
session         required        /usr/local/lib/pam_mkhomedir.so mode=0700
session         required        pam_permit.so

password        sufficient      /usr/local/lib/pam_sss.so       use_authtok
password        sufficient      pam_krb5.so             use_authtok forwardable
password        required        pam_unix.so             no_warn try_first_pass

I also tried
auth sufficient pam_krb5.so no_warn try_first_pass forwardable ccache=krb5cc_%u

There is an option to just run kinit in the .profile, but I'm trying to avoid entering the password.

Is using pam_exec.so an option? I can do echo PASSWORD | kinit --password-file=STDIN which works, so can I call this somehow?

References

1. Similar to this guy, but on FreeBSD 10.3 Initialise Kerberos ticket on ssh login using PAM
2. man pam_krb5.so https://www.freebsd.org/cgi/man.cgi?query=pam_krb5&sektion=8
3. Similar, but does not get around the no-password issue Get Kerberos ticket with SSH
4. http://web.archive.org/web/20150315074946/http://howtovmlinux.com/articles/infrastructure-management/red-hat-idm/automate-kinit-kerberos-ticket-during-ssh-login.html

Question

What SELinux context do I need, for what file to get apache ldap (over ssl) auth to work? Or is it a network protocol or system call or something else entirely?

Environment

Apache 2.4 on Centos 7 using basic ldap authentication over ssl.

With SELinux permissive (setenforce 0), everything runs well and fine. I can log in to the protected directory with ldap perfectly.

When SELinux is enabled (setenforce 1), apache cannot perform the ldap search and allow the user through. It has something to do with ssl or certificates and I can't figure it out.

/var/log/httpd/ssl_error_log

[Thu Mar 17 15:33:32.529755 2016] [authnz_ldap:debug] [pid 6412] mod_authnz_ldap.c(501): [client 158.158.193.232:17386] AH01691: auth_ldap authenticate: using URL ldaps://ldap-ad.example.org:636/ou=Auto-Accounts,dc=example,dc=org?sAMAccountname?sub
[Thu Mar 17 15:33:32.530792 2016] [ldap:debug] [pid 6412] util_ldap.c(372): AH01278: LDAP: Setting referrals to On.
[Thu Mar 17 15:33:32.531845 2016] [ldap:debug] [pid 6412] util_ldap.c(372): AH01278: LDAP: Setting referrals to On.
[Thu Mar 17 15:33:32.532936 2016] [ldap:debug] [pid 6412] util_ldap.c(372): AH01278: LDAP: Setting referrals to On.
[Thu Mar 17 15:33:32.533568 2016] [authnz_ldap:info] [pid 6412] [client 158.158.193.232:17386] AH01695: auth_ldap authenticate: user bgstack15 authentication failed; URI /auth1/ [LDAP: ldap_simple_bind() failed][Can't contact LDAP server]
[Thu Mar 17 15:33:32.533784 2016] [ssl:debug] [pid 6412] ssl_engine_io.c(992): [client 158.158.193.232:17386] AH02001: Connection closed to child 1 with standard shutdown (server sample.example.org:443)

/var/log/audit/audit.log

type=AVC msg=audit(1458243341.951:1234): avc:  denied  { name_connect } for  pid=6428 comm="httpd" dest=636 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1458243341.951:1234): arch=c000003e syscall=42 success=no exit=-13 a0=12 a1=7f2c0498eab0 a2=10 a3=0 items=0 ppid=6409 pid=6428 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1458243341.952:1235): avc:  denied  { name_connect } for  pid=6428 comm="httpd" dest=636 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1458243341.952:1235): arch=c000003e syscall=42 success=no exit=-13 a0=12 a1=7f2c0498eab0 a2=10 a3=0 items=0 ppid=6409 pid=6428 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1458243341.952:1236): avc:  denied  { name_connect } for  pid=6428 comm="httpd" dest=636 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1458243341.952:1236): arch=c000003e syscall=42 success=no exit=-13 a0=12 a1=7f2c0498d580 a2=10 a3=0 items=0 ppid=6409 pid=6428 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1458243341.953:1237): avc:  denied  { name_connect } for  pid=6428 comm="httpd" dest=636 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1458243341.953:1237): arch=c000003e syscall=42 success=no exit=-13 a0=12 a1=7f2c0498d580 a2=10 a3=0 items=0 ppid=6409 pid=6428 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)

What I've tried already

I have started reading up on SELinux and have tried copying the context from other certificates. I tried doing that on the certificates in /etc/openldap/certs and also /etc/pki/tls/certs. Perhaps I need to try something for the tcp port 636?

Updates

SElinux: allow httpd to connect to a specific port provides a working solution, but it is not refined for maximum security yet. The command

setsebool httpd_can_network_connect on

allows httpd to perform the ldaps bind. However, this opens up httpd too much so I am still looking for a way to allow just port 636.

Environment: Tomcat 7.0 on Windows 2008 R2

What to accomplish

Get Tomcat 7.0 to use a specific wildcard certificate with accompanying cert chain so customers' browsers do not throw errors. The provided certificate is a wildcard cert. This is non-negotiable and irrelevant to getting the certificate installed.

My problem is that I cannot get tomcat to use the chain (root certificates) in addition to the main cert.

What I've tried

At first it took me forever to get the certificate working with the provided key pair. References 2 and 3 showed me these steps to import a provided key pair as a "PrivateKeyEntry" which Tomcat likes better:

#on a CentOS server cuz easier than getting a windows tool for it
openssl pkcs12 -export -in wildcard-customer-2016.crt -inkey wildcard-customer-2016.key -out wildcard-customer-2016.p12 -name wildcard -CAfile rapidssl.crt -caname root

#back on windows
C:\Program Files\Java\jre7\bin\keytool -importkeystore -deststorepass tomcat -destkeystore c:\.keystore -srckeystore c:\certificate\wildcard-customer-2016\wildcard-customer-2016.p12 -srcstoretype PKCS12 -alias wildcard

But I don't know how to add the root certificate so that it uses that as well. You can see the command I used to build the .p12 file included a CAfile command. The importkeystore command when run with a "-trustcacerts" didn't add the root certs, although it did work with the *.customer.com cert.

Possible alternatives
Somebody explain how to configure my server.xml for using APR properly. Pretend I don't know where the files from the zip file go. (Reference 4)

References

1. https://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html
2. https://stackoverflow.com/questions/906402/importing-an-existing-x509-certificate-and-private-key-in-java-keystore-to-use-i
3. http://cunning.sharp.fm/2008/06/importing_private_keys_into_a.html
4. Create jks for tomcat using .key ,.ca and .cert file

We're running Windows 2012 with AD LDS (aka ADAM). We're troubleshooting an application, and the ADAM sync command that runs hourly is filling up our event log.

The event viewer filters show how to exclude criteria for event IDs, but not how to exclude users. Our service account is performing all the ldap_modify statements and we don't need to see those. Because our authentication process uses ldap_search (event IDs 1138 or 1139), we can't just exclude all of those events.

Does anyone know how to exclude users in event viewer filters?

I am installing Active Directory Lightweight Directory Services (AD LDS, aka ADAM) on a Windows 2012 vm. After finally getting the configuration of the directory and synchronization handled, I am now running into an interesting problem. I have researched online for hours already, and I could use some expert advice.

When I use "Network Service" account as the service account for my LDS instance, I cannot initiate a connection on the SSL port (which I left as the default of 636) at all. We can make connections to the non-SSL port of 389. The same occurs for the domain service account "ADLDSSRVC."

When I use my personal domain credentials as the service account, we can use non-SSL connections on the non-SSL port and SSL connections on the SSL port. On the SSL connection, we can then bind to the LDS using the AD DS accounts via proxy bind redirection. My domain account has local admin rights on the host.

Do I need to make the domain service account, "ADLDSSRVC" a local admin? My boss wants to do this only as a last resort if I can't give it just the permissions I need. More specifically, I would like to know, if it's possible, what permissions the service account needs so that I can make SSL ldap connections to my AD LDS instance. A Technet article indicates that the ADLDS service account needs create, read, and modify access to %ProgramFiles%\Microsoft ADAM\instancename\data, but that didn't seem to make a difference for opening up port 636.

Blog.uvm.edu tells to do the following: Open the AD Users and Computers tool, locate the computer object on which you installed the Instance. Give the LDS service account “create all child objects” to the computer object. I'm not a domain admin, so I can't do that. Is that basically the same as making the service account a local admin?