Centos 7 after unroll and join to new server authorization doesn’t work

[Petar Kozić]

Hi,
I have one IPA server dirsrv001 and newone dirsrv002

dirsrv001 is old server from where I want to unroll my VPS’s and join to
new server. I do some testing with Ubuntu VPS’s and that works perfect.

I have problem with one Centos 7 server.
I join client to dirsrv002 without problems but when I want to login I
login over ssh but I can’t do sudo. Ask me for pass and than three times
and that is.
Sudo permission on IPA server is configured as well because works on other.

If I run on that Centos client command:
kinit my_username

and when I enter pass everything is ok.

If I check syslog, I get this error:

[sssd[krb5_child[8541]]]: Key version is not available

I found that is problem with /etc/krb5.keytab file. But I tried to unroll
client, move that file and join again, problem was same.

Please, does someone have some idea?

*—*
*Petar Kozić*

[François Cami]

Hi,

On Fri, Jan 31, 2020 at 2:48 PM Petar Kozić via FreeIPA-users
 wrote:
> Hi,
> I have one IPA server dirsrv001 and newone dirsrv002
>
> dirsrv001 is old server from where I want to unroll my VPS’s and join to new server. I do some testing with Ubuntu VPS’s and that works perfect.
>
> I have problem with one Centos 7 server.
> I join client to dirsrv002 without problems but when I want to login I login over ssh but I can’t do sudo. Ask me for pass and than three times and that is.
> Sudo permission on IPA server is configured as well because works on other.
>
> If I run on that Centos client command:
> kinit my_username
>
> and when I enter pass everything is ok.
>
> If I check syslog, I get this error:
>
> [sssd[krb5_child[8541]]]: Key version is not available
>
> I found that is problem with /etc/krb5.keytab file. But I tried to unroll client, move that file and join again, problem was same.
>
> Please, does someone have some idea?

I would make sure all client caches were cleaned up, like:
~/.cache/ipa/

François
> —
> Petar Kozić
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

[Petar Kozić]

Hi,

On Fri, Jan 31, 2020 at 2:48 PM Petar Kozić via FreeIPA-users
 wrote:
> Hi,
> I have one IPA server dirsrv001 and newone dirsrv002
>
> dirsrv001 is old server from where I want to unroll my VPS’s and join to

new server. I do some testing with Ubuntu VPS’s and that works perfect.
> I have problem with one Centos 7 server.
> I join client to dirsrv002 without problems but when I want to login I

login over ssh but I can’t do sudo. Ask me for pass and than three times
and that is.
> Sudo permission on IPA server is configured as well because works on

other.
> If I run on that Centos client command:
> kinit my_username
>
> and when I enter pass everything is ok.
>
> If I check syslog, I get this error:
>
> [sssd[krb5_child[8541]]]: Key version is not available
>
> I found that is problem with /etc/krb5.keytab file. But I tried to unroll

client, move that file and join again, problem was same.
> Please, does someone have some idea?

I would make sure all client caches were cleaned up, like:
~/.cache/ipa/

François

There is no one .cache folder under ~/home/
I have several users which connect but no one don’t have that .cache

[Petar Kozić]

But this help me:

systemctl stop sssd

rm -rf /var/lib/sss/db/*

systemctl restart sssd

*—*

*Petar Kozić*

Hi,

On Fri, Jan 31, 2020 at 2:48 PM Petar Kozić via FreeIPA-users
 wrote:
> Hi,
> I have one IPA server dirsrv001 and newone dirsrv002
>
> dirsrv001 is old server from where I want to unroll my VPS’s and join to

new server. I do some testing with Ubuntu VPS’s and that works perfect.
> I have problem with one Centos 7 server.
> I join client to dirsrv002 without problems but when I want to login I

login over ssh but I can’t do sudo. Ask me for pass and than three times
and that is.
> Sudo permission on IPA server is configured as well because works on

other.
> If I run on that Centos client command:
> kinit my_username
>
> and when I enter pass everything is ok.
>
> If I check syslog, I get this error:
>
> [sssd[krb5_child[8541]]]: Key version is not available
>
> I found that is problem with /etc/krb5.keytab file. But I tried to unroll

client, move that file and join again, problem was same.
> Please, does someone have some idea?

I would make sure all client caches were cleaned up, like:
~/.cache/ipa/

François

There is no one .cache folder under ~/home/
I have several users which connect but no one don’t have that .cache

[Sumit Bose]

On Fri, Jan 31, 2020 at 06:03:50AM -0800, Petar Kozić via FreeIPA-users wrote:
> But this help me:
>
> systemctl stop sssd
>
> rm -rf /var/lib/sss/db/*

Hi,

when you say 'join client to dirsrv002' I guess you run a new and separate IPA
domain/instance on 'dirsrv002'. If you used the same domain and realm name for
both instance most probably your old but still valid Kerberos ccache
/var/lib/sss/db/ccache_IPA.REALM was still in this directory and SSSD tried to
authenticate to the new domain with the credentials from the old.

bye,
Sumit
> systemctl restart sssd
>
> *—*
>
> *Petar Kozić*
>
> Hi,
>
> On Fri, Jan 31, 2020 at 2:48 PM Petar Kozić via FreeIPA-users
>  wrote:
> > Hi,
> > I have one IPA server dirsrv001 and newone dirsrv002
> >
> > dirsrv001 is old server from where I want to unroll my VPS’s and join to
>
> new server. I do some testing with Ubuntu VPS’s and that works perfect.
> > I have problem with one Centos 7 server.
> > I join client to dirsrv002 without problems but when I want to login I
>
> login over ssh but I can’t do sudo. Ask me for pass and than three times
> and that is.
> > Sudo permission on IPA server is configured as well because works on
>
> other.
> > If I run on that Centos client command:
> > kinit my_username
> >
> > and when I enter pass everything is ok.
> >
> > If I check syslog, I get this error:
> >
> > [sssd[krb5_child[8541]]]: Key version is not available
> >
> > I found that is problem with /etc/krb5.keytab file. But I tried to unroll
>
> client, move that file and join again, problem was same.
> > Please, does someone have some idea?
>
> I would make sure all client caches were cleaned up, like:
> ~/.cache/ipa/
>
> François
>
> There is no one .cache folder under ~/home/
> I have several users which connect but no one don’t have that .cache
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

[Petar Kozić]

Yes, you are right, I bring up on same domain and realm.
Thanks for informing me.

On Fri, Jan 31, 2020, 17:22 Sumit Bose via FreeIPA-users <
[e-mail]> wrote:
> On Fri, Jan 31, 2020 at 06:03:50AM -0800, Petar Kozić via FreeIPA-users
> wrote:
> > But this help me:
> >
> > systemctl stop sssd
> >
> > rm -rf /var/lib/sss/db/*
>
> Hi,
>
> when you say 'join client to dirsrv002' I guess you run a new and separate
> IPA
> domain/instance on 'dirsrv002'. If you used the same domain and realm name
> for
> both instance most probably your old but still valid Kerberos ccache
> /var/lib/sss/db/ccache_IPA.REALM was still in this directory and SSSD
> tried to
> authenticate to the new domain with the credentials from the old.
>
> bye,
> Sumit
> > systemctl restart sssd
> >
> > *—*
> >
> > *Petar Kozić*
> >
> > Hi,
> >
> > On Fri, Jan 31, 2020 at 2:48 PM Petar Kozić via FreeIPA-users
> >  wrote:
> > > Hi,
> > > I have one IPA server dirsrv001 and newone dirsrv002
> > >
> > > dirsrv001 is old server from where I want to unroll my VPS’s and join
>
> to
> > new server. I do some testing with Ubuntu VPS’s and that works perfect.
> > > I have problem with one Centos 7 server.
> > > I join client to dirsrv002 without problems but when I want to login I
> >
> > login over ssh but I can’t do sudo. Ask me for pass and than three times
> > and that is.
> > > Sudo permission on IPA server is configured as well because works on
> >
> > other.
> > > If I run on that Centos client command:
> > > kinit my_username
> > >
> > > and when I enter pass everything is ok.
> > >
> > > If I check syslog, I get this error:
> > >
> > > [sssd[krb5_child[8541]]]: Key version is not available
> > >
> > > I found that is problem with /etc/krb5.keytab file. But I tried to
>
> unroll
> > client, move that file and join again, problem was same.
> > > Please, does someone have some idea?
> >
> > I would make sure all client caches were cleaned up, like:
> > ~/.cache/ipa/
> >
> > François
> >
> > There is no one .cache folder under ~/home/
> > I have several users which connect but no one don’t have that .cache
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to
>
> [e-mail]
> > Fedora Code of Conduct:
>
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
>
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...