Manual IPA client install

[Mark Haney]

So, I'm /this/ close to getting a pair of servers in Alaska (on very 
slow links) setup for IPA authentication.  I've followed the 
documentation here:

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/htm...

since these two servers are CentOS 6.9.  I'm almost certain I've got 
everything setup correctly, but I'm still unable to login as an IPA user 
either with SSH or with su - <username>. I get '<username> does not 
exist'. However, I /can/ 'kinit admin' /and/ 'kinit mark.haney' 
successfully:

[root@rad8 nnsrad]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: [e-mail]

Valid starting     Expires            Service principal
10/17/17 15:05:47  10/18/17 15:05:24 krbtgt/[e-mail]

Note that my user account does not exist on the local machine and never 
has.  And the admin account, while one exists locally, has a different 
password than the IPA admin.

Rob Crittenden had me check the keytab KVNO and it matches with the KVNO 
of the IPA server.  The one issue I can definitely say I have is this:

kinit -kt /etc/krb5.keytab
kinit: Generic preauthentication failure while getting initial credentials

Rob said the keytab might be out of sync, but unless I'm following his 
instructions incorrectly, they do match.  Anyone else have ideas on how 
to get this working?

[Jochen Hein]

Mark Haney via FreeIPA-users 
writes:
> since these two servers are CentOS 6.9.  I'm almost certain I've got
> everything setup correctly, but I'm still unable to login as an IPA
> user either with SSH or with su - <username>. I get '<username> does
> not exist'. However, I /can/ 'kinit admin' /and/ 'kinit mark.haney'
> successfully:

This looks like some problem with sssd.  Do you see your user with "id
<username"?  Have a look at
https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html
> Rob Crittenden had me check the keytab KVNO and it matches with the
> KVNO of the IPA server.  The one issue I can definitely say I have is
> this:
>
> kinit -kt /etc/krb5.keytab
> kinit: Generic preauthentication failure while getting initial credentials

Can you show a trace with "KRB5_TRACE=/dev/stderr kinit -kt
/etc/krb5.keytab"?  What do you see in the KDC log?

Jochen

[Rob Crittenden]

Jochen Hein via FreeIPA-users wrote:
> Mark Haney via FreeIPA-users 
> writes:
> > since these two servers are CentOS 6.9.  I'm almost certain I've got
> > everything setup correctly, but I'm still unable to login as an IPA
> > user either with SSH or with su - <username>. I get '<username> does
> > not exist'. However, I /can/ 'kinit admin' /and/ 'kinit mark.haney'
> > successfully:
>
> This looks like some problem with sssd.  Do you see your user with "id
> <username"?  Have a look at
> https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html

Yes, I'd start there as well. The keytab/kvno things I had you do was to 
confirm that the keytab was ok. sssd won't work with IPA without a valid 
keytab. Since you've confirmed that it works you can move onto sssd 
troubleshooting.

rob
> > Rob Crittenden had me check the keytab KVNO and it matches with the
> > KVNO of the IPA server.  The one issue I can definitely say I have is
> > this:
> >
> > kinit -kt /etc/krb5.keytab
> > kinit: Generic preauthentication failure while getting initial credentials
>
> Can you show a trace with "KRB5_TRACE=/dev/stderr kinit -kt
> /etc/krb5.keytab"?  What do you see in the KDC log?
>
> Jochen

[Mark Haney]

On 10/18/2017 03:58 AM, Rob Crittenden wrote:
> > This looks like some problem with sssd. Do you see your user with "id
> > <username"?  Have a look at
> > https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html
>
> Yes, I'd start there as well. The keytab/kvno things I had you do was 
> to confirm that the keytab was ok. sssd won't work with IPA without a 
> valid keytab. Since you've confirmed that it works you can move onto 
> sssd troubleshooting.
>
> rob

Well, after a couple of days of slamming by head against other issues 
(and being on-call this entire week!) I finally had some time to work on 
this again.  Not long after I posted my previous reply, I generated a 
new keytab and installed it on the problem server and not I do no get 
the 'generic preauthentication error' as before. So, I've been debugging 
SSSD.  Here's a snippet of the logs that might help with this issue:

[resolv_discover_srv_done] (0x0040): SRV query failed [4]: Domain name 
not found
[sssd[be[neonova.net]]] [fo_set_port_status] (0x0100): Marking port 0 of 
server '(no name)' as 'not working'
[sssd[be[neonova.net]]] [resolve_srv_done] (0x0040): Unable to resolve 
SRV [1432158229]: SRV record not found
[sssd[be[neonova.net]]] [set_srv_data_status] (0x0100): Marking SRV 
lookup of service 'IPA' as 'not resolved'
[sssd[be[neonova.net]]] [be_resolve_server_process] (0x0080): Couldn't 
resolve server (SRV lookup meta-server), resolver returned (1432158229)
[sssd[be[neonova.net]]] [fo_resolve_service_send] (0x0100): Trying to 
resolve service 'IPA'
[sssd[be[neonova.net]]] [resolv_gethostbyname_files_send] (0x0100): 
Trying to resolve A record of 'ipa1.neonova.net' in files
[sssd[be[neonova.net]]] [set_server_common_status] (0x0100): Marking 
server 'ipa1.neonova.net' as 'resolving name'
[sssd[be[neonova.net]]] [resolv_gethostbyname_files_send] (0x0100): 
Trying to resolve AAAA record of 'ipa1.neonova.net' in files
[sssd[be[neonova.net]]] [resolv_gethostbyname_dns_query] (0x0100): 
Trying to resolve A record of 'ipa1.neonova.net' in DNS
[sssd[be[neonova.net]]] [set_server_common_status] (0x0100): Marking 
server 'ipa1.neonova.net' as 'name resolved'
[sssd[be[neonova.net]]] [generic_ext_search_handler] (0x0040): 
sdap_get_generic_ext_recv failed [110]: Connection timed out
[sssd[be[neonova.net]]] [fo_set_port_status] (0x0100): Marking port 0 of 
server 'ipa1.neonova.net' as 'not working'

I've attached the full log if that helps.  I'm pretty sure the issue now 
might be that while the client can resolve the name of the IPA servers, 
when requesting data from either of them, the ports are being blocked.  
This was a problem on some of the other customer boxes we have out in 
the world.  But, is there anything else in the logs that might also be 
an issue?  This was Debug level 4, BTW. I can turn it up higher if need 
be, but figured this would be a good starting point.