Closed Itinerary3543 closed 6 months ago
There are several errors in your execution.
Mostly you need to ensure your environment is providing correct set up to allow operations to run. Samba is expecting ability to switch between root and other users and set effective groups/users details on the processes it starts. This might be in conflict with docker configuration of the containerized namespaces. In particular, if this is about rootless container, your subid/subgid ranges need to be able to work with the IDs expected by Samba and FreeIPA, if you run them in containers. Using setgroups() also requires CAP_SETGID capability, it needs to be allowed for this container namespace, and also seccomp filter needs to allow those operations.
The default RPC server dynamic port range is in higher numbers, not 1024-1300. From smb.conf(5)
:
Default: rpc server dynamic port range = 49152-65535
So we're definitely using the userns-remap = default value in the docker.json which means the root user in the container is not the same userid as the root on the host, but I don't know if that is the same as "rootless". What changes need to be made to subid and subgid to accommodate this? I had suspected this could have been a cause based on some searches and we tried adding 5000000 to the /etc/subid and /etc/subgid to the dockremap entry but continued seeing the same error. How can we determine how many ids to add to the range for this?
This is the first time I've seen any mention of the CAP_SETGID capability but we can try setting this.
For the ports, we were using this guide, Free IPA Active Directory Trust Setup where we gleaned the ports 1024-1300 from but we didn't notice the 49152-65535, we'll keep that in mind. Is this a better guide for this purpose? https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html-single/installing_trust_between_idm_and_ad/index
Regarding documentation, you should be using RHEL IdM documentation as that is the primary source. FreeIPA wiki does not change over time.
I should make it clear: containerized FreeIPA setup was never tested with trust to Active Directory feature. Containerized FreeIPA setup is also not supported beyond what is written in the Readme document here. There is no production support for it. If things work, fine, if they break and that can be reproduced with non-containerized deployment, fine -- report a bug to FreeIPA upstream. Otherwise, there is no support for it.
@abbra, while I agree with your general description of the situation, @Itinerary3543's question "How can we determine how many ids to add to the range for this?" might we worth exploring though. Assuming the problem is really the uids being exhausted in the user namespace, what is the ultimate way to set the uid range Samba uses in this case, to keep it under whatever limits are set in /etc/subuid
/subgid
?
I don't think it is going to be a problem if you do not do 1:1 reuse of the host namespace in the container.
@Itinerary3543 Have you made some progress with the investigation, for example testing that CAP_SETGID?
We seem to have lost traction here.
We have setup two test systems, a containerized FreeIPA and a VM running Active Directory. After running IPA server install with the below settings and then running ipa-adtrust-install in the container, we attempt to add the trust with
The command prompts for the AD Admin password then errors out with the following error:
If you check the SMB log this error is present:
Couple things stick out here:
I'm unclear what actions Samba is taking during the trust-add step and the logging is somewhat vague. Below is the ipa install commands we're running
ipa-server-install-options
samba.log.172.17.0.2.txt