[RISOLTO] Autenticazione Kerberos e apertura al mondo

marcolefo · 18 giugno 2020 - 17:23

Ciao

Sto configurando un server WAPT 1.8.2 su Debian 10 accessibile dall'esterno tramite autenticazione client Kerberos.

Sono bloccato nel tentativo di registrare il mio primo cliente.
waptserver.log:

Codice: Seleziona tutto

[waptserver     ] CRITICAL Get_websocket_auth_token failed EWaptAuthenticationFailure(u'Unknown host UUID client.domain.lan. Please register first.',)
[waptws         ] WARNING SocketIO connection refused for uuid client.domain.lan, sid f186984275bc44ed8e5d12c56448c9c1: SocketIO connection not authorized, invalid token: 400 Bad Request: The browser (or proxy) sent a request that this server could not understand., instance
 [waptws         ] WARNING Application rejected connection

Per quanto riguarda il cliente:

Codice: Seleziona tutto

> wapt-get register -l debug --service
Current loglevel : DEBUG
About to speak to waptservice...
Call register URL...
url: http://127.0.0.1:8088/register.json?notify_user=1 timeout: 10000
url: http://127.0.0.1:8088/events?max_count=1 timeout: 11000
Waptservice User :url: http://127.0.0.1:8088/events?max_count=1 : OK Duration: 0

Dopo aver letto la documentazione e il forum, mi chiedo se ciò non sia dovuto al fatto che la macchina ha un nome sia locale che esterno:
wapt.domain.local e wapt.domain.fr

sapendo che il mio AD serve il dominio domain.local

Tutti i miei clienti dovrebbero usare wapt.domain.fr, il mio DNS si risolve su IP privato se la richiesta è interna e su IP pubblico se la richiesta è esterna.

Ho seguito le istruzioni https://www.wapt.fr/fr/doc/wapt-securit ... t=kerberos

Quindi ho registrato il mio computer come wapt.domain.local.

Il problema è legato al nome della macchina server?

18 giugno 2020 - 22:07

Le stazioni sono in grado di negoziare un ticket Kerberos?

Su un sistema Windows 10, puoi provare il seguente comando:

Codice: Seleziona tutto

klist get HTTP/srvwapt.mydomain.lan

srvwapt.mydomain.lan deve essere sostituito con l'URL utilizzato dai tuoi client (in modo da poter effettuare il test con i nomi DNS interni ed esterni)

Si noti che per negoziare un ticket, la posizione deve essere in grado di contattare il proprio AD.

Successivamente, la keytab sul server deve avere entrambi gli URL.

Per verificare:

Codice: Seleziona tutto

ktutil
read_kt /etc/nginx/http-krb5.keytab
list

Questo ti fornisce l'elenco degli URL accettati da Keytab

Il mio consiglio è di utilizzare un unico nome DNS, quello esterno

Altrimenti, è necessario adattare questo comando per passarlo a due servizi HTTP:

Codice: Seleziona tutto

sudo msktutil --server DOMAIN_CONTROLER --precreate --host $(hostname) -b cn=computers --service HTTP --description "host account for wapt server" --enctypes 24 -N

https://www.wapt.fr/fr/doc-1.7/security ... ice-keytab

marcolefo · 19 giugno 2020 - 15:47

Ho rigenerato il keytab utilizzando il nome esterno:

Codice: Seleziona tutto

msktutil --server ad.domain.local --precreate --host wapt.domain.fr -b cn=computers --service HTTP --description "Host account for wapt server" --enctypes 24 -N

Ma lui si lamenta che il nome è troppo lungo

Codice: Seleziona tutto

Error: The SAM name (nomduserveur-domain-fr$) for this host is longer than the maximum of MAX_SAM_ACCOUNT_LEN characters
Error: You can specify a shorter name using --computer-name

Quindi ho provato

Codice: Seleziona tutto

msktutil --server ad.domain.local --precreate --computer-name wapt --host wapt.domain.fr -b cn=computers --service HTTP --description "Host account for wapt server" --enctypes 24 -N

Codice: Seleziona tutto

# ktutil
ktutil:  read_kt /etc/nginx/http-krb5.keytab
ktutil:  list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    5                            wapt$@DOMAIN.LOCAL
   2    5                            wapt$@DOMAIN.LOCAL
   3    5                            wapt$@DOMAIN.LOCAL
   4    5                            WAPT$@DOMAIN.LOCAL
   5    5                            WAPT$@DOMAIN.LOCAL
   6    5                            WAPT$@DOMAIN.LOCAL
   7    5                        host/wapt@DOMAIN.LOCAL
   8    5                        host/wapt@DOMAIN.LOCAL
   9    5                        host/wapt@DOMAIN.LOCAL
  10    5    HTTP/nomdns.domain.fr@DOMAIN.LOCAL
  11    5    HTTP/nomdns.domain.fr@DOMAIN.LOCAL
  12    5    HTTP/nomdns.domain.fr@DOMAIN.LOCAL

In realtà, wapt.domain.fr è un record CNAME di nomdns.domain.fr...

Quindi ricomincio da capo senza usare il CNAME wapt.domain.fr

Questa volta la postazione di lavoro del cliente arriva a:

Codice: Seleziona tutto

klist get HTTP/nomdns.domain.fr

LogonId est 0:0x2c7b3b
Un ticket pour HTTP/nomdns.domain.fr a été récupéré.

Tickets mis en cache : (3)

#0>     Client : domainadminuser @ DOMAIN.LOCAL
        Serveur : krbtgt/DOMAIN.LOCAL @ DOMAIN.LOCAL
        Type de chiffrement KerbTicket : AES-256-CTS-HMAC-SHA1-96
        Indicateurs de tickets 0x40e10000 -> forwardable renewable initial pre_authent name_canonicalize
        Heure de démarrage : 6/19/2020 15:38:35 (Local)
        Heure de fin :   6/20/2020 1:38:35 (Local)
        Heure de renouvellement : 6/26/2020 9:21:31 (Local)
        Type de clé de session : AES-256-CTS-HMAC-SHA1-96
        Indicateurs de cache : 0x1 -> PRIMARY
        KDC appelé : adserver.DOMAIN.LOCAL

#1>     Client : domainadminuser @ DOMAIN.LOCAL
        Serveur : HTTP/nomdns.domain.fr @ DOMAIN.LOCAL
        Type de chiffrement KerbTicket : AES-256-CTS-HMAC-SHA1-96
        Indicateurs de tickets 0x40a10000 -> forwardable renewable pre_authent name_canonicalize
        Heure de démarrage : 6/19/2020 15:38:35 (Local)
        Heure de fin :   6/20/2020 1:38:35 (Local)
        Heure de renouvellement : 6/26/2020 9:21:31 (Local)
        Type de clé de session : AES-256-CTS-HMAC-SHA1-96
        Indicateurs de cache : 0
        KDC appelé : adserver.DOMAIN.LOCAL

#2>     Client : domainadminuser @ DOMAIN.LOCAL
        Serveur : HTTP/nomdns.DOMAIN.LOCAL @ DOMAIN.LOCAL
        Type de chiffrement KerbTicket : AES-256-CTS-HMAC-SHA1-96
        Indicateurs de tickets 0x40a10000 -> forwardable renewable pre_authent name_canonicalize
        Heure de démarrage : 6/19/2020 9:21:31 (Local)
        Heure de fin :   6/19/2020 19:21:31 (Local)
        Heure de renouvellement : 6/26/2020 9:21:31 (Local)
        Type de clé de session : AES-256-CTS-HMAC-SHA1-96
        Indicateurs de cache : 0
        KDC appelé : adserver.DOMAIN.LOCAL

Ma ancora nessuna registrazione. In C:\Programmi (x86)\wapt\log\waptservice.log:

Codice: Seleziona tutto

Serving on http://client.domain.local:8088
2020-06-19 15:39:18,051 [waptws         ] WARNING Websocket connect params: Unable to get auth token: Error on server:
EWaptAuthenticationFailure(u'Unknown host UUID UUID_masquée. Please register first.',)
Get packages index
u'0 paquet(s) dans le d\xe9p\xf4t\nLe syst\xe8me est \xe0 jour'
2020-06-19 15:39:30,640 [waptcore       ] WARNING Host on the server is not known or not known under this FQDN name (known as None). Trying to register the computer...
	System Power Controls
2020-06-19 15:40:18,213 [waptws         ] WARNING Websocket connect params: Unable to get auth token: Error on server:
EWaptAuthenticationFailure(u'Unknown host UUID UUID_masquée. Please register first.',)
2020-06-19 15:41:18,358 [waptws         ] WARNING Websocket connect params: Unable to get auth token: Error on server:
EWaptAuthenticationFailure(u'Unknown host UUID UUID_masquée. Please register first.',)
2020-06-19 15:42:18,500 [waptws         ] WARNING Websocket connect params: Unable to get auth token: Error on server:
EWaptAuthenticationFailure(u'Unknown host UUID UUID_masquée. Please register first.',)
2020-06-19 15:43:18,647 [waptws         ] WARNING Websocket connect params: Unable to get auth token: Error on server:
EWaptAuthenticationFailure(u'Unknown host UUID UUID_masquée. Please register first.',)

Penso che siamo vicini, ma non vedo dove stia il problema

marcolefo · 19 giugno 2020 - 18:09

Vorrei riassumere il mio approccio. Spero sia chiaro.

Contesto:

Dominio AD => dominio.locale
Pubblico dominio => dominio.pubblico

Server WAPT:
Nome DNS locale => foo.domain.local
Nome DNS pubblico => foo.domain.public
CNAME => wapt.domain.public

Client WAPT => client.dominio.locale

Sul server WAPT:

Codice: Seleziona tutto

# cat /etc/krb5.conf
[libdefaults]
  default_realm = DOMAIN.LOCAL
  dns_lookup_realm = false
  dns_lookup_kdc = true

[realms]
  DOMAIN.LOCAL = {
    kdc = adserver.domain.local
  }

[domain_realm]
  .domain.local = DOMAIN.LOCAL
  domain.local = DOMAIN.LOCAL

Creazione del keytab:

Codice: Seleziona tutto

# kinit admin
Password for admin@DOMAIN.LOCAL:
# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin@DOMAIN.LOCAL

Valid starting       Expires              Service principal
06/19/2020 17:32:32  06/20/2020 03:32:32  krbtgt/DOMAIN.LOCAL@DOMAIN.LOCAL
	renew until 06/20/2020 17:32:26
06/19/2020 17:32:59  06/20/2020 03:32:32  ldap/adserver.domain.local@
	renew until 06/20/2020 17:32:26
06/19/2020 17:32:59  06/20/2020 03:32:32  ldap/adserver.domain.local@DOMAIN.LOCAL
	renew until 06/20/2020 17:32:26
06/19/2020 17:32:59  06/19/2020 17:34:59  kadmin/changepw@DOMAIN.LOCAL
	renew until 06/19/2020 17:34:59
# msktutil --server ad.domain.local --precreate --computer-name toto --host toto.domain.public -b cn=computers --service HTTP --description "Host account for wapt server" --enctypes 24 -N
No computer account for toto found, creating a new one.
# msktutil --server ad.domain.local --auto-update --keytab /etc/nginx/http-krb5.keytab --computer-name toto --host toto.domain.public  -N
# chmod 640 /etc/nginx/http-krb5.keytab; chown root:www-data /etc/nginx/http-krb5.keytab

Controlliamo:

Codice: Seleziona tutto

ktutil
read_kt /etc/nginx/http-krb5.keytab
list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    3                          toto$@DOMAIN.LOCAL
   2    3                          toto$@DOMAIN.LOCAL
   3    3                          toto$@DOMAIN.LOCAL
   4    3                          TOTO$@DOMAIN.LOCAL
   5    3                          TOTO$@DOMAIN.LOCAL
   6    3                          TOTO$@DOMAIN.LOCAL
   7    3                      host/toto@DOMAIN.LOCAL
   8    3                      host/toto@DOMAIN.LOCAL
   9    3                      host/toto@DOMAIN.LOCAL
  10    3    HTTP/toto.domain.public@DOMAIN.LOCAL
  11    3    HTTP/toto.domain.public@DOMAIN.LOCAL
  12    3    HTTP/toto.domain.public@DOMAIN.LOCAL

Riavviamo la post-conferenza abilitando l'autenticazione Kerberos

Codice: Seleziona tutto

/opt/wapt/waptserver/scripts/postconf.sh --force-https

Il passaggio successivo non è stato testato su una workstation "normale", bensì sulla workstation responsabile della creazione dell'agente. I certificati CA e CS erano già stati creati durante le installazioni precedenti.

Sul PC Windows 10:

Codice: Seleziona tutto

C:\Windows\system32>klist get HTTP/toto.domain.public

LogonId est 0:0x2c7b3b
Un ticket pour HTTP/toto.domain.public a été récupéré.

Tickets mis en cache : (3)

#0>     Client : admin-user @ DOMAIN.LOCAL
        Serveur : krbtgt/DOMAIN.LOCAL @ DOMAIN.LOCAL
        Type de chiffrement KerbTicket : AES-256-CTS-HMAC-SHA1-96
        Indicateurs de tickets 0x40e10000 -> forwardable renewable initial pre_authent name_canonicalize
        Heure de démarrage : 6/19/2020 17:42:39 (Local)
        Heure de fin :   6/20/2020 3:42:39 (Local)
        Heure de renouvellement : 6/26/2020 9:21:31 (Local)
        Type de clé de session : AES-256-CTS-HMAC-SHA1-96
        Indicateurs de cache : 0x1 -> PRIMARY
        KDC appelé : adserver.domain.local

#1>     Client : admin-user @ DOMAIN.LOCAL
        Serveur : HTTP/toto.domain.public @ DOMAIN.LOCAL
        Type de chiffrement KerbTicket : AES-256-CTS-HMAC-SHA1-96
        Indicateurs de tickets 0x40a10000 -> forwardable renewable pre_authent name_canonicalize
        Heure de démarrage : 6/19/2020 17:42:39 (Local)
        Heure de fin :   6/20/2020 3:42:39 (Local)
        Heure de renouvellement : 6/26/2020 9:21:31 (Local)
        Type de clé de session : AES-256-CTS-HMAC-SHA1-96
        Indicateurs de cache : 0
        KDC appelé : adserver.domain.local

#2>     Client : admin-user @ DOMAIN.LOCAL
        Serveur : HTTP/toto.domain.local @ DOMAIN.LOCAL
        Type de chiffrement KerbTicket : AES-256-CTS-HMAC-SHA1-96
        Indicateurs de tickets 0x40a10000 -> forwardable renewable pre_authent name_canonicalize
        Heure de démarrage : 6/19/2020 9:21:31 (Local)
        Heure de fin :   6/19/2020 19:21:31 (Local)
        Heure de renouvellement : 6/26/2020 9:21:31 (Local)
        Type de clé de session : AES-256-CTS-HMAC-SHA1-96
        Indicateurs de cache : 0
        KDC appelé : adserver.domain.local

Disinstalliamo WAPT e reinstalliamo waptsetup-tis.
Per impostazione predefinita, la console tenta di registrare (add_host) il client, richiedendo la password di amministratore => annulla
Copiare il file di licenza in C:\Programmi (x86)\wapt\licenses
Copiamo i certificati creati in precedenza in C:\Programmi (x86)\wapt\ssl

Modifichiamo il file C:\Program Files (x86)\wapt\log\waptservice.log per abilitare Kerberos:

Codice: Seleziona tutto

use_kerberos=1

Riavviamo il servizio WAPT e poi, in C:\Programmi (x86)\wapt\log\waptservice.log:

Codice: Seleziona tutto

Serving on http://client.domain.local:8088
2020-06-19 17:42:23,803 [waptws         ] WARNING Websocket connect params: Unable to get auth token: Error on server:
EWaptAuthenticationFailure(u'Unknown host UUID 4C4C4544-. Please register first.',)
Get packages index
u'2 paquet(s) dans le d\xe9p\xf4t\nLe syst\xe8me est \xe0 jour'
2020-06-19 17:42:36,398 [waptcore       ] WARNING Host on the server is not known or not known under this FQDN name (known as None). Trying to register the computer...
	System Power Controls
2020-06-19 17:43:23,960 [waptws         ] WARNING Websocket connect params: Unable to get auth token: Error on server:
EWaptAuthenticationFailure(u'Unknown host UUID 4C4C4544-. Please register first.',)

20 giugno 2020 - 12:49

marcolefo ha scritto: ↑19 giugno 2020 - 15:47 In realtà, wapt.domain.fr è un record CNAME per nomdns.domain.fr...

Come negli esempi, non ho i nomi DNS reali, quindi è complicato orientarsi.

In pratica, non importa se si tratta di un record CNAME o A; il nome DNS utilizzato dal tuo agente (quello in wapt-get.ini in wapt_server) deve apparire nell'output di lettura di ktutil nel formato:

Codice: Seleziona tutto

HTTP/nomdns.fqdn@DOMAIN.LOCAL

È inoltre necessario che l'ordine

Codice: Seleziona tutto

klist get HTTP/nomdns.fqdn@DOMAIN.LOCAL

Il tuo agente sta lavorando.
Se funziona.
Puoi testare con un psexec:

Codice: Seleziona tutto

psexec -s -i cmd
klist purge
wapt-get register

Attenzione! È molto facile perdersi riavviando il processo più volte (problemi di creazione, ecc.). Se vuoi ripartire da zero, puoi seguire questa procedura:

Sul server wapt:

Codice: Seleziona tutto

rm -f /etc/nginx/http-krb5.keytab

Su AD:
Eliminazione dell'account del computer wapt

Sul tuo computer di prova Windows:

Codice: Seleziona tutto

psexec -s -i cmd
klist purge

marcolefo · 23 giugno 2020 - 16:45

Ottimo! Stiamo facendo progressi.

Non funziona ancora, ma ci sono progressi. Sono riuscito ad aggiungere il CNAME al keytab forzando il servizio --Servizio HTTP/wapt.dominio.pubblico

Codice: Seleziona tutto

 msktutil --server ad.domain.local --precreate --computer-name toto --host wapt.domain.public -b cn=computers --service HTTP/wapt.domain.public --description "Host account for wapt server" --enctypes 24 -N

Grazie per il consiglio sulla purificazione, credo che fosse quello che mi bloccava...

Ora se eseguo un registro wapt-get:

Codice: Seleziona tutto

wapt-get register
Using config file: C:\Program Files (x86)\wapt\wapt-get.ini
Registering host against server: https://wapt.domain.public
        System Power Controls
FATAL ERROR : HTTPError: 403 Client Error: Forbidden for url: https://wapt.domain.public/add_host_kerberos

In modalità debug...

Codice: Seleziona tutto

wapt-get register -l debug
Current loglevel : DEBUG
2020-06-23 16:41:55,690 DEBUG Default encoding : ascii
2020-06-23 16:41:55,691 DEBUG Setting encoding for stdout and stderr to cp850
2020-06-23 16:41:55,697 DEBUG Python path ['C:\\Program Files (x86)\\wapt', 'C:\\Program Files (x86)\\wapt', 'C:\\Program Files (x86)\\wapt\\python27.zip', 'C:\\Program Files (x86)\\wapt\\DLLs', 'C:\\Program Files (x86)\\wapt\\lib', 'C:\\Program Files (x86)\\wapt\\lib\\plat-win', 'C:\\Program Files (x86)\\wapt\\lib\\lib-tk', 'C:\\Program Files (x86)\\wapt', 'C:\\Program Files (x86)\\wapt\\lib\\site-packages', 'C:\\Program Files (x86)\\wapt\\lib\\site-packages\\pywin32-227-py2.7-win32.egg', 'C:\\Program Files (x86)\\wapt\\lib\\site-packages\\win32', 'C:\\Program Files (x86)\\wapt\\lib\\site-packages\\win32\\lib', 'C:\\Program Files (x86)\\wapt\\lib\\site-packages\\Pythonwin']
2020-06-23 16:41:55,698 INFO Using local waptservice configuration C:\Program Files (x86)\wapt\wapt-get.ini
2020-06-23 16:41:55,698 DEBUG Config file: C:\Program Files (x86)\wapt\wapt-get.ini
Using config file: C:\Program Files (x86)\wapt\wapt-get.ini
2020-06-23 16:41:55,711 DEBUG Thread 8048 is connecting to wapt db
2020-06-23 16:41:55,799 DEBUG Using host certificate C:\Program Files (x86)\wapt\private\4C4C4544-0051-4C10-804C-B7C04F443033.pem for repo global auth
2020-06-23 16:41:55,841 DEBUG Thread 8048 is connecting to wapt db
2020-06-23 16:41:55,842 DEBUG DB Start transaction
2020-06-23 16:41:55,842 DEBUG DB commit
2020-06-23 16:41:55,934 DEBUG Using host certificate C:\Program Files (x86)\wapt\private\4C4C4544-0051-4C10-804C-B7C04F443033.pem for repo wapt auth
2020-06-23 16:41:55,973 INFO Main repository: https://wapt.domain.public/wapt
2020-06-23 16:41:56,112 DEBUG Using host certificate C:\Program Files (x86)\wapt\private\4C4C4544-0051-4C10-804C-B7C04F443033.pem for repo wapt-host auth
2020-06-23 16:41:56,153 INFO User Groups:[]
2020-06-23 16:41:56,153 DEBUG WAPT base directory : C:\Program Files (x86)\wapt
2020-06-23 16:41:56,154 DEBUG Package cache dir : C:\Program Files (x86)\wapt\cache
2020-06-23 16:41:56,154 DEBUG WAPT DB Structure version;: 20200415
Registering host against server: https://wapt.domain.public
2020-06-23 16:41:56,154 DEBUG DB Start transaction
2020-06-23 16:41:56,158 DEBUG DB commit
2020-06-23 16:41:56,181 DEBUG DB Start transaction
2020-06-23 16:41:56,183 DEBUG DB commit
2020-06-23 16:41:56,186 DEBUG DB Start transaction
2020-06-23 16:41:56,187 DEBUG DB commit
2020-06-23 16:41:56,467 DEBUG Unable to GET username from SID S-1-5-21-105001 : (1332, 'LookupAccountSid', 'Le mappage entre les noms de compte et les ID de s\xe9curit\xe9 n\x92a pas \xe9t\xe9 effectu\xe9.'), using profile directory instead
2020-06-23 16:41:56,470 DEBUG Unable to GET username from SID S-1-5-21-105001 : (1332, 'LookupAccountSid', 'Le mappage entre les noms de compte et les ID de s\xe9curit\xe9 n\x92a pas \xe9t\xe9 effectu\xe9.'), using profile directory instead
2020-06-23 16:41:56,525 DEBUG DB Start transaction
2020-06-23 16:41:56,529 DEBUG DB commit
2020-06-23 16:41:56,535 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,538 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,539 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,540 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,543 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,548 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,552 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,555 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,559 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,565 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,569 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,573 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,581 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,586 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,592 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,598 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,605 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,612 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,619 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,628 DEBUG Stores cert chain check in cache
2020-06-23 16:41:56,740 INFO Run "dmidecode -q"
2020-06-23 16:41:56,749 INFO dmidecode -q command returns code 0
        System Power Controls
2020-06-23 16:41:59,147 DEBUG Loading ssl context with cert C:\Program Files (x86)\wapt\private\4C4C4544-0051-4C10-804C-B7C04F443033.crt and key C:\Program Files (x86)\wapt\private\4C4C4544-0051-4C10-804C-B7C04F443033.pem
2020-06-23 16:41:59,153 DEBUG Starting new HTTPS connection (1): wapt.domain.public:443
2020-06-23 16:41:59,171 DEBUG https://wapt.domain.public:443 "POST /add_host_kerberos HTTP/1.1" 401 195
2020-06-23 16:41:59,174 DEBUG https://wapt.domain.public:443 "POST /add_host_kerberos HTTP/1.1" 401 195
2020-06-23 16:41:59,174 DEBUG handle_401(): Handling: 401
2020-06-23 16:41:59,177 DEBUG authenticate_user(): Authorization header: Negotiate YIIGSAYJKoZIhvcSAQICAQBuggY3MIIGM6ADAgEFoQMCAQ6iBwMFACAAAACjggRuYYIEajCCBGagAwIBBaEJGwd
...
GsVFs2HdSnmLrsr6REVVsoU2vQVrDnDVWBWgJsaR+2XBMCdNJeZmz9rv3PHAilS3jp2/UTElocXczY3f4gSnqLhWcaJSgRSJUruPF+f9KdTy41CLb3f7gVlzvoFv4sQtGaVQyurHII3vf5Ng1uzFiVlAq8/cxU30M7ivZEwiYgv+o9dd9Ar+1Ze//32GLc4AAsbqn7gliNx06DY0g/DgkoU/mYS8982gvRybFQXn1yVo1yhIMoeI4EiM1aV1Cx3KwnrKXIQR2U9/1CWhhth89gOQJusBpv0DDA==
2020-06-23 16:41:59,178 DEBUG https://wapt.domain.public:443 "POST /add_host_kerberos HTTP/1.1" 403 169
2020-06-23 16:41:59,183 DEBUG authenticate_user(): returning <Response [403]>
2020-06-23 16:41:59,183 DEBUG handle_401(): returning <Response [403]>
2020-06-23 16:41:59,183 DEBUG handle_response(): returning <Response [403]>
2020-06-23 16:41:59,183 DEBUG handle_response() has seen 0 401 responses
2020-06-23 16:41:59,184 DEBUG handle_other(): Handling: 403
2020-06-23 16:41:59,184 DEBUG handle_other(): returning <Response [403]>
2020-06-23 16:41:59,184 DEBUG handle_response(): returning <Response [403]>
FATAL ERROR : HTTPError: 403 Client Error: Forbidden for url: https://wapt.domain.public/add_host_kerberos
Traceback (most recent call last):
  File "<string>", line 1462, in <module>
  File "<string>", line 1241, in main
  File "C:\Program Files (x86)\wapt\common.py", line 5641, in register_computer
    signer = self.get_host_certificate().cn
  File "C:\Program Files (x86)\wapt\common.py", line 1969, in post
    req.raise_for_status()
  File "C:\Program Files (x86)\wapt\lib\site-packages\requests\models.py", line 940, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://wapt.domain.public/add_host_kerberos
Exception at 0044233C: EPyIOError:
HTTPError: 403 Client Error: Forbidden for url: https://wapt.domain.public/add_host_kerberos.

Nota che prima di registrarmi ho eseguito una `klist purge`. Ecco il risultato della `klist` dopo la registrazione

Codice: Seleziona tutto

>klist

LogonId est 0:0x3e7

Tickets mis en cache : (2)

#0>     Client : client$ @ DOMAIN.LOCAL
        Serveur : krbtgt/DOMAIN.LOCAL @ DOMAIN.LOCAL
        Type de chiffrement KerbTicket : AES-256-CTS-HMAC-SHA1-96
        Indicateurs de tickets 0x40e10000 -> forwardable renewable initial pre_authent name_canonicalize
        Heure de démarrage : 6/23/2020 16:59:29 (Local)
        Heure de fin :   6/24/2020 2:59:29 (Local)
        Heure de renouvellement : 6/30/2020 16:59:29 (Local)
        Type de clé de session : AES-256-CTS-HMAC-SHA1-96
        Indicateurs de cache : 0x1 -> PRIMARY
        KDC appelé : adserver.domain.local

#1>     Client : client$ @ DOMAIN.LOCAL
        Serveur : HTTP/wapt.domain.public @ DOMAIN.LOCAL
        Type de chiffrement KerbTicket : AES-256-CTS-HMAC-SHA1-96
        Indicateurs de tickets 0x40a10000 -> forwardable renewable pre_authent name_canonicalize
        Heure de démarrage : 6/23/2020 16:59:29 (Local)
        Heure de fin :   6/24/2020 2:59:29 (Local)
        Heure de renouvellement : 6/30/2020 16:59:29 (Local)
        Type de clé de session : AES-256-CTS-HMAC-SHA1-96
        Indicateurs de cache : 0
        KDC appelé : adserver.domain.local

Ci stiamo avvicinando, vero?

marcolefo · 23 giugno 2020 - 17:46

Ed ecco fatto, dopo una rapida chiamata all'assistenza, funziona!

Il post sopra era perfettamente corretto, ma con tutti i miei tentativi avevo semplicemente dimenticato di impostare i permessi corretti sul keytab

Codice: Seleziona tutto

chmod 640 /etc/nginx/http-krb5.keytab; chown root:www-data /etc/nginx/http-krb5.keytab