sssd-users February 2017

sssd-users@lists.fedorahosted.org

22 participants
23 discussions

SSSD - user id mapping
by Thomas Beaudry 22 Feb '17

22 Feb '17

Hi Everyone, I am running into a problem with usernames disappearing (and being replaced by their uids). The prompt in the terminal also changes to "i have no name!@<HOST>" Jakub suggested that it could be that the getgr* is failing for some reason Here is the timestamp for when the error happens: I have no name!@perf-imglab08:~$ date Wed Jan 18 17:22:19 EST 2017 I have no name!@perf-imglab08:~$ getent group 1234 I have no name!@perf-imglab08:~$ date Wed Jan 18 17:22:36 EST 2017 and here are my sssd logs: sssd.log (Wed Jan 18 17:22:13 2017) [sssd] [service_send_ping] (0x2000): Pinging concordia.ca (Wed Jan 18 17:22:13 2017) [sssd] [sbus_add_timeout] (0x2000): 0x146a570 (Wed Jan 18 17:22:13 2017) [sssd] [service_send_ping] (0x2000): Pinging nss (Wed Jan 18 17:22:13 2017) [sssd] [sbus_add_timeout] (0x2000): 0x1473220 (Wed Jan 18 17:22:13 2017) [sssd] [service_send_ping] (0x2000): Pinging pam (Wed Jan 18 17:22:13 2017) [sssd] [sbus_add_timeout] (0x2000): 0x146a4e0 (Wed Jan 18 17:22:13 2017) [sssd] [service_send_ping] (0x2000): Pinging ssh (Wed Jan 18 17:22:13 2017) [sssd] [sbus_add_timeout] (0x2000): 0x1478db0 (Wed Jan 18 17:22:13 2017) [sssd] [service_send_ping] (0x2000): Pinging autofs (Wed Jan 18 17:22:13 2017) [sssd] [sbus_add_timeout] (0x2000): 0x146a4a0 (Wed Jan 18 17:22:13 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x1473220 (Wed Jan 18 17:22:13 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x146e7c0 (Wed Jan 18 17:22:13 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:13 2017) [sssd] [ping_check] (0x2000): Service nss replied to ping (Wed Jan 18 17:22:13 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x146a570 (Wed Jan 18 17:22:13 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x1468c00 (Wed Jan 18 17:22:13 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:13 2017) [sssd] [ping_check] (0x2000): Service concordia.ca replied to ping (Wed Jan 18 17:22:13 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x146a4e0 (Wed Jan 18 17:22:13 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x1474870 (Wed Jan 18 17:22:13 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:13 2017) [sssd] [ping_check] (0x2000): Service pam replied to ping (Wed Jan 18 17:22:13 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x1478db0 (Wed Jan 18 17:22:13 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x14700f0 (Wed Jan 18 17:22:13 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:13 2017) [sssd] [ping_check] (0x2000): Service ssh replied to ping (Wed Jan 18 17:22:13 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x146a4a0 (Wed Jan 18 17:22:13 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x1471e30 (Wed Jan 18 17:22:13 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:13 2017) [sssd] [ping_check] (0x2000): Service autofs replied to ping (Wed Jan 18 17:22:23 2017) [sssd] [service_send_ping] (0x2000): Pinging concordia.ca (Wed Jan 18 17:22:23 2017) [sssd] [sbus_add_timeout] (0x2000): 0x146a4a0 (Wed Jan 18 17:22:23 2017) [sssd] [service_send_ping] (0x2000): Pinging nss (Wed Jan 18 17:22:23 2017) [sssd] [sbus_add_timeout] (0x2000): 0x1478db0 (Wed Jan 18 17:22:23 2017) [sssd] [service_send_ping] (0x2000): Pinging pam (Wed Jan 18 17:22:23 2017) [sssd] [sbus_add_timeout] (0x2000): 0x146a4e0 (Wed Jan 18 17:22:23 2017) [sssd] [service_send_ping] (0x2000): Pinging ssh (Wed Jan 18 17:22:23 2017) [sssd] [sbus_add_timeout] (0x2000): 0x146a570 (Wed Jan 18 17:22:23 2017) [sssd] [service_send_ping] (0x2000): Pinging autofs (Wed Jan 18 17:22:23 2017) [sssd] [sbus_add_timeout] (0x2000): 0x1473220 (Wed Jan 18 17:22:23 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x1478db0 (Wed Jan 18 17:22:23 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x146e7c0 (Wed Jan 18 17:22:23 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:23 2017) [sssd] [ping_check] (0x2000): Service nss replied to ping (Wed Jan 18 17:22:23 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x146a4e0 (Wed Jan 18 17:22:23 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x1474870 (Wed Jan 18 17:22:23 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:23 2017) [sssd] [ping_check] (0x2000): Service pam replied to ping (Wed Jan 18 17:22:23 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x146a570 (Wed Jan 18 17:22:23 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x14700f0 (Wed Jan 18 17:22:23 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:23 2017) [sssd] [ping_check] (0x2000): Service ssh replied to ping (Wed Jan 18 17:22:23 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x146a4a0 (Wed Jan 18 17:22:23 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x1468c00 (Wed Jan 18 17:22:23 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:23 2017) [sssd] [ping_check] (0x2000): Service concordia.ca replied to ping (Wed Jan 18 17:22:23 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x1473220 (Wed Jan 18 17:22:23 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x1471e30 (Wed Jan 18 17:22:23 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:23 2017) [sssd] [ping_check] (0x2000): Service autofs replied to ping (Wed Jan 18 17:22:33 2017) [sssd] [service_send_ping] (0x2000): Pinging concordia.ca (Wed Jan 18 17:22:33 2017) [sssd] [sbus_add_timeout] (0x2000): 0x1473220 (Wed Jan 18 17:22:33 2017) [sssd] [service_send_ping] (0x2000): Pinging nss (Wed Jan 18 17:22:33 2017) [sssd] [sbus_add_timeout] (0x2000): 0x146a4a0 (Wed Jan 18 17:22:33 2017) [sssd] [service_send_ping] (0x2000): Pinging pam (Wed Jan 18 17:22:33 2017) [sssd] [sbus_add_timeout] (0x2000): 0x146a570 (Wed Jan 18 17:22:33 2017) [sssd] [service_send_ping] (0x2000): Pinging ssh (Wed Jan 18 17:22:33 2017) [sssd] [sbus_add_timeout] (0x2000): 0x146a4e0 (Wed Jan 18 17:22:33 2017) [sssd] [service_send_ping] (0x2000): Pinging autofs (Wed Jan 18 17:22:33 2017) [sssd] [sbus_add_timeout] (0x2000): 0x1478db0 (Wed Jan 18 17:22:33 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x146a4a0 (Wed Jan 18 17:22:33 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x146e7c0 (Wed Jan 18 17:22:33 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:33 2017) [sssd] [ping_check] (0x2000): Service nss replied to ping (Wed Jan 18 17:22:33 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x146a570 (Wed Jan 18 17:22:33 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x1474870 (Wed Jan 18 17:22:33 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:33 2017) [sssd] [ping_check] (0x2000): Service pam replied to ping (Wed Jan 18 17:22:33 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x1473220 (Wed Jan 18 17:22:33 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x1468c00 (Wed Jan 18 17:22:33 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:33 2017) [sssd] [ping_check] (0x2000): Service concordia.ca replied to ping (Wed Jan 18 17:22:33 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x146a4e0 (Wed Jan 18 17:22:33 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x14700f0 (Wed Jan 18 17:22:33 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:33 2017) [sssd] [ping_check] (0x2000): Service ssh replied to ping (Wed Jan 18 17:22:33 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x1478db0 (Wed Jan 18 17:22:33 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x1471e30 (Wed Jan 18 17:22:33 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:33 2017) [sssd] [ping_check] (0x2000): Service autofs replied to ping (Wed Jan 18 17:22:43 2017) [sssd] [service_send_ping] (0x2000): Pinging concordia.ca (Wed Jan 18 17:22:43 2017) [sssd] [sbus_add_timeout] (0x2000): 0x1478db0 (Wed Jan 18 17:22:43 2017) [sssd] [service_send_ping] (0x2000): Pinging nss (Wed Jan 18 17:22:43 2017) [sssd] [sbus_add_timeout] (0x2000): 0x146a4e0 (Wed Jan 18 17:22:43 2017) [sssd] [service_send_ping] (0x2000): Pinging pam (Wed Jan 18 17:22:43 2017) [sssd] [sbus_add_timeout] (0x2000): 0x1473220 (Wed Jan 18 17:22:43 2017) [sssd] [service_send_ping] (0x2000): Pinging ssh (Wed Jan 18 17:22:43 2017) [sssd] [sbus_add_timeout] (0x2000): 0x146a570 (Wed Jan 18 17:22:43 2017) [sssd] [service_send_ping] (0x2000): Pinging autofs (Wed Jan 18 17:22:43 2017) [sssd] [sbus_add_timeout] (0x2000): 0x146a4a0 (Wed Jan 18 17:22:43 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x146a4e0 (Wed Jan 18 17:22:43 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x146e7c0 (Wed Jan 18 17:22:43 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:43 2017) [sssd] [ping_check] (0x2000): Service nss replied to ping (Wed Jan 18 17:22:43 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x1473220 (Wed Jan 18 17:22:43 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x1474870 (Wed Jan 18 17:22:43 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:43 2017) [sssd] [ping_check] (0x2000): Service pam replied to ping (Wed Jan 18 17:22:43 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x1478db0 (Wed Jan 18 17:22:43 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x1468c00 (Wed Jan 18 17:22:43 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:43 2017) [sssd] [ping_check] (0x2000): Service concordia.ca replied to ping (Wed Jan 18 17:22:43 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x146a570 (Wed Jan 18 17:22:43 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x14700f0 (Wed Jan 18 17:22:43 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:43 2017) [sssd] [ping_check] (0x2000): Service ssh replied to ping (Wed Jan 18 17:22:43 2017) [sssd] [sbus_remove_timeout] (0x2000): 0x146a4a0 (Wed Jan 18 17:22:43 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x1471e30 (Wed Jan 18 17:22:43 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:43 2017) [sssd] [ping_check] (0x2000): Service autofs replied to ping sssd_concordia.ca.log (Wed Jan 18 17:22:13 2017) [sssd[be[concordia.ca]]] [sbus_dispatch] (0x4000): dbus conn: 0xaa5740 (Wed Jan 18 17:22:13 2017) [sssd[be[concordia.ca]]] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:13 2017) [sssd[be[concordia.ca]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.service.ping on path /org/freedesktop/sssd/service (Wed Jan 18 17:22:13 2017) [sssd[be[concordia.ca]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Wed Jan 18 17:22:23 2017) [sssd[be[concordia.ca]]] [sbus_dispatch] (0x4000): dbus conn: 0xaa5740 (Wed Jan 18 17:22:23 2017) [sssd[be[concordia.ca]]] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:23 2017) [sssd[be[concordia.ca]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.service.ping on path /org/freedesktop/sssd/service (Wed Jan 18 17:22:23 2017) [sssd[be[concordia.ca]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [sbus_dispatch] (0x4000): dbus conn: 0xaa5740 (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.service.ping on path /org/freedesktop/sssd/service (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [sbus_dispatch] (0x4000): dbus conn: 0xaeeb80 (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.dataprovider.getAccountInfo on path /org/freedesktop/sssd/dataprovider (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [be_get_account_info] (0x0200): Got request for [0x1002][FAST BE_REQ_GROUP][1][idnumber=1234] (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [be_get_account_info] (0x0100): Request processed. Returned 1,11,Fast reply - offline (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [be_req_set_domain] (0x0400): Changing request domain from [concordia.ca] to [concordia.ca] (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [sbus_dispatch] (0x4000): dbus conn: 0xaeeb80 (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.dataprovider.getAccountInfo on path /org/freedesktop/sssd/dataprovider (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [be_get_account_info] (0x0200): Got request for [0x1002][FAST BE_REQ_GROUP][1][idnumber=1234] (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [be_get_account_info] (0x0100): Request processed. Returned 1,11,Fast reply - offline (Wed Jan 18 17:22:33 2017) [sssd[be[concordia.ca]]] [be_req_set_domain] (0x0400): Changing request domain from [concordia.ca] to [forestroot.concordia.montreal.qc.ca] (Wed Jan 18 17:22:43 2017) [sssd[be[concordia.ca]]] [sbus_dispatch] (0x4000): dbus conn: 0xaa5740 (Wed Jan 18 17:22:43 2017) [sssd[be[concordia.ca]]] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 18 17:22:43 2017) [sssd[be[concordia.ca]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.service.ping on path /org/freedesktop/sssd/service (Wed Jan 18 17:22:43 2017) [sssd[be[concordia.ca]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit ldap_child.log (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [main] (0x0400): ldap_child started. (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [main] (0x2000): context initialized (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [unpack_buffer] (0x1000): total buffer size: 50 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [unpack_buffer] (0x1000): realm_str size: 12 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [unpack_buffer] (0x1000): got realm_str: CONCORDIA.CA (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [unpack_buffer] (0x1000): princ_str size: 14 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [unpack_buffer] (0x1000): got princ_str: PERF-IMGLAB08$ (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [unpack_buffer] (0x1000): keytab_name size: 0 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [unpack_buffer] (0x1000): lifetime: 86400 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [unpack_buffer] (0x0200): Will run as [0][0]. (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [privileged_krb5_setup] (0x2000): Kerberos context initialized (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [main] (0x2000): Kerberos context initialized (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [become_user] (0x0200): Trying to become user [0][0]. (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [become_user] (0x0200): Already user [0]. (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [main] (0x2000): Running as [0][0]. (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [main] (0x2000): getting TGT sync (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [ldap_child_get_tgt_sync] (0x2000): got realm_name: [CONCORDIA.CA] (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [ldap_child_get_tgt_sync] (0x0100): Principal name is: [PERF-IMGLAB08$(a)CONCORDIA.CA] (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [ldap_child_get_tgt_sync] (0x0100): Using keytab [MEMORY:/etc/krb5.keytab] (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.728189: Getting initial credentials for PERF-IMGLAB08$(a)CONCORDIA.CA (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.728262: Looked up etypes in keytab: des-cbc-crc, des, des-cbc-crc, rc4-hmac, aes128-cts, aes256-cts (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.728291: Sending request (195 bytes) to CONCORDIA.CA (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.728317: Resolving hostname Int-con-dc-1.concordia.ca (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.729762: Sending initial UDP request to dgram 132.205.123.21:88 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.731123: Received answer (210 bytes) from dgram 132.205.123.21:88 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.734046: Response was not from master KDC (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.734082: Received error from KDC: -1765328359/Additional pre-authentication required (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.734104: Processing preauth types: 16, 15, 19, 2 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.734112: Selected etype info: etype aes256-cts, salt "CONCORDIA.CAhostperf-imglab08.concordia.ca", params "" (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.734127: Retrieving PERF-IMGLAB08$(a)CONCORDIA.CA from MEMORY:/etc/krb5.keytab (vno 0, enctype aes256-cts) with result: 0/Success (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.734137: AS key obtained for encrypted timestamp: aes256-cts/FC36 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.734161: Encrypted timestamp (for 1484778122.795789): plain 301AA011180F32303137303131383232323230325AA10502030C248D, encrypted 77571640DED5412F7668B68A1684793B574BFD047B5D9F7CC62D4197B088FB59018B3BB6E748E651507780452E6B4E8CC31F67FF4A31EEBD (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.734168: Preauth module encrypted_timestamp (2) (real) returned: 0/Success (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.734173: Produced preauth for next request: 2 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.734189: Sending request (275 bytes) to CONCORDIA.CA (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.734196: Resolving hostname Int-con-dc-1.concordia.ca (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.735879: Sending initial UDP request to dgram 132.205.123.21:88 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.737712: Received answer (96 bytes) from dgram 132.205.123.21:88 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.739940: Response was not from master KDC (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.739968: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.739978: Request or response is too big for UDP; retrying with TCP (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.739986: Sending request (275 bytes) to CONCORDIA.CA (tcp only) (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.739996: Resolving hostname Int-con-dc-1.concordia.ca (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.741680: Initiating TCP connection to stream 132.205.123.21:88 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.742475: Sending TCP request to stream 132.205.123.21:88 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.744227: Received answer (1508 bytes) from stream 132.205.123.21:88 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.744240: Terminating TCP connection to stream 132.205.123.21:88 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.745376: Response was not from master KDC (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.745404: Processing preauth types: 19 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.745412: Selected etype info: etype aes256-cts, salt "CONCORDIA.CAhostperf-imglab08.concordia.ca", params "" (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.745419: Produced preauth for next request: (empty) (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.745425: AS key determined by preauth: aes256-cts/FC36 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.745450: Decrypted AS reply; session key is: aes256-cts/7A2A (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.745455: FAST negotiation: unavailable (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [ldap_child_get_tgt_sync] (0x2000): credentials initialized (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [ldap_child_get_tgt_sync] (0x2000): keytab ccname: [FILE:/var/lib/sss/db/ccache_CONCORDIA.CA_OaPYPl] (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.745483: Initializing FILE:/var/lib/sss/db/ccache_CONCORDIA.CA_OaPYPl with default princ PERF-IMGLAB08$(a)CONCORDIA.CA (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [sss_child_krb5_trace_cb] (0x4000): [25844] 1484778122.745537: Storing PERF-IMGLAB08$(a)CONCORDIA.CA -> krbtgt/CONCORDIA.CA(a)CONCORDIA.CA in FILE:/var/lib/sss/db/ccache_CONCORDIA.CA_OaPYPl (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [ldap_child_get_tgt_sync] (0x2000): credentials stored (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [ldap_child_get_tgt_sync] (0x2000): Got KDC time offset (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [ldap_child_get_tgt_sync] (0x2000): Renaming [/var/lib/sss/db/ccache_CONCORDIA.CA_OaPYPl] to [/var/lib/sss/db/ccache_CONCORDIA.CA] (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [unique_filename_destructor] (0x2000): Unlinking [/var/lib/sss/db/ccache_CONCORDIA.CA_OaPYPl] (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [unlink_dbg] (0x2000): File already removed: [/var/lib/sss/db/ccache_CONCORDIA.CA_OaPYPl] (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [prepare_response] (0x0400): Building response for result [0] (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [pack_buffer] (0x2000): response size: 60 (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [pack_buffer] (0x1000): result [0] krberr [0] msgsize [40] msg [FILE:/var/lib/sss/db/ccache_CONCORDIA.CA] (Wed Jan 18 17:22:02 2017) [[sssd[ldap_child[25844]]]] [main] (0x0400): ldap_child completed successfully (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [main] (0x0400): ldap_child started. (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [main] (0x2000): context initialized (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [unpack_buffer] (0x1000): total buffer size: 50 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [unpack_buffer] (0x1000): realm_str size: 12 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [unpack_buffer] (0x1000): got realm_str: CONCORDIA.CA (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [unpack_buffer] (0x1000): princ_str size: 14 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [unpack_buffer] (0x1000): got princ_str: PERF-IMGLAB08$ (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [unpack_buffer] (0x1000): keytab_name size: 0 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [unpack_buffer] (0x1000): lifetime: 86400 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [unpack_buffer] (0x0200): Will run as [0][0]. (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [privileged_krb5_setup] (0x2000): Kerberos context initialized (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [main] (0x2000): Kerberos context initialized (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [become_user] (0x0200): Trying to become user [0][0]. (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [become_user] (0x0200): Already user [0]. (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [main] (0x2000): Running as [0][0]. (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [main] (0x2000): getting TGT sync (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [ldap_child_get_tgt_sync] (0x2000): got realm_name: [CONCORDIA.CA] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [ldap_child_get_tgt_sync] (0x0100): Principal name is: [PERF-IMGLAB08$(a)CONCORDIA.CA] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [ldap_child_get_tgt_sync] (0x0100): Using keytab [MEMORY:/etc/krb5.keytab] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.791179: Getting initial credentials for PERF-IMGLAB08$(a)CONCORDIA.CA (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.791382: Looked up etypes in keytab: des-cbc-crc, des, des-cbc-crc, rc4-hmac, aes128-cts, aes256-cts (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.791490: Sending request (195 bytes) to CONCORDIA.CA (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.791569: Resolving hostname Int-con-dc-1.concordia.ca (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.793862: Sending initial UDP request to dgram 132.205.123.21:88 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.795622: Received answer (210 bytes) from dgram 132.205.123.21:88 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.798139: Response was not from master KDC (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.798175: Received error from KDC: -1765328359/Additional pre-authentication required (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.798194: Processing preauth types: 16, 15, 19, 2 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.798201: Selected etype info: etype aes256-cts, salt "CONCORDIA.CAhostperf-imglab08.concordia.ca", params "" (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.798214: Retrieving PERF-IMGLAB08$(a)CONCORDIA.CA from MEMORY:/etc/krb5.keytab (vno 0, enctype aes256-cts) with result: 0/Success (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.798226: AS key obtained for encrypted timestamp: aes256-cts/FC36 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.798251: Encrypted timestamp (for 1484778188.864327): plain 301AA011180F32303137303131383232323330385AA10502030D3047, encrypted D1207C76AB678F2BBC0336F2F2EE373DF28682250D27A98B1249180CF5319FC7199D6018C0A44399945C235ECF9B295704D6EAEC3F5FF5FD (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.798259: Preauth module encrypted_timestamp (2) (real) returned: 0/Success (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.798264: Produced preauth for next request: 2 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.798278: Sending request (275 bytes) to CONCORDIA.CA (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.798286: Resolving hostname Int-con-dc-1.concordia.ca (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.799446: Sending initial UDP request to dgram 132.205.123.21:88 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.801292: Received answer (96 bytes) from dgram 132.205.123.21:88 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.803814: Response was not from master KDC (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.803836: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.803844: Request or response is too big for UDP; retrying with TCP (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.803850: Sending request (275 bytes) to CONCORDIA.CA (tcp only) (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.803858: Resolving hostname Int-con-dc-1.concordia.ca (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.805392: Initiating TCP connection to stream 132.205.123.21:88 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.806522: Sending TCP request to stream 132.205.123.21:88 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.808296: Received answer (1508 bytes) from stream 132.205.123.21:88 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.808314: Terminating TCP connection to stream 132.205.123.21:88 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.809712: Response was not from master KDC (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.809737: Processing preauth types: 19 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.809747: Selected etype info: etype aes256-cts, salt "CONCORDIA.CAhostperf-imglab08.concordia.ca", params "" (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.809755: Produced preauth for next request: (empty) (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.809763: AS key determined by preauth: aes256-cts/FC36 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.809790: Decrypted AS reply; session key is: aes256-cts/A0EB (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.809796: FAST negotiation: unavailable (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [ldap_child_get_tgt_sync] (0x2000): credentials initialized (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [ldap_child_get_tgt_sync] (0x2000): keytab ccname: [FILE:/var/lib/sss/db/ccache_CONCORDIA.CA_btC2E5] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.809829: Initializing FILE:/var/lib/sss/db/ccache_CONCORDIA.CA_btC2E5 with default princ PERF-IMGLAB08$(a)CONCORDIA.CA (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [sss_child_krb5_trace_cb] (0x4000): [25873] 1484778188.809880: Storing PERF-IMGLAB08$(a)CONCORDIA.CA -> krbtgt/CONCORDIA.CA(a)CONCORDIA.CA in FILE:/var/lib/sss/db/ccache_CONCORDIA.CA_btC2E5 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [ldap_child_get_tgt_sync] (0x2000): credentials stored (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [ldap_child_get_tgt_sync] (0x2000): Got KDC time offset (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [ldap_child_get_tgt_sync] (0x2000): Renaming [/var/lib/sss/db/ccache_CONCORDIA.CA_btC2E5] to [/var/lib/sss/db/ccache_CONCORDIA.CA] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [unique_filename_destructor] (0x2000): Unlinking [/var/lib/sss/db/ccache_CONCORDIA.CA_btC2E5] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [unlink_dbg] (0x2000): File already removed: [/var/lib/sss/db/ccache_CONCORDIA.CA_btC2E5] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [prepare_response] (0x0400): Building response for result [0] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [pack_buffer] (0x2000): response size: 60 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [pack_buffer] (0x1000): result [0] krberr [0] msgsize [40] msg [FILE:/var/lib/sss/db/ccache_CONCORDIA.CA] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25873]]]] [main] (0x0400): ldap_child completed successfully (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [main] (0x0400): ldap_child started. (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [main] (0x2000): context initialized (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [unpack_buffer] (0x1000): total buffer size: 50 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [unpack_buffer] (0x1000): realm_str size: 12 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [unpack_buffer] (0x1000): got realm_str: CONCORDIA.CA (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [unpack_buffer] (0x1000): princ_str size: 14 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [unpack_buffer] (0x1000): got princ_str: PERF-IMGLAB08$ (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [unpack_buffer] (0x1000): keytab_name size: 0 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [unpack_buffer] (0x1000): lifetime: 86400 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [unpack_buffer] (0x0200): Will run as [0][0]. (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [privileged_krb5_setup] (0x2000): Kerberos context initialized (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [main] (0x2000): Kerberos context initialized (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [become_user] (0x0200): Trying to become user [0][0]. (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [become_user] (0x0200): Already user [0]. (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [main] (0x2000): Running as [0][0]. (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [main] (0x2000): getting TGT sync (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [ldap_child_get_tgt_sync] (0x2000): got realm_name: [CONCORDIA.CA] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [ldap_child_get_tgt_sync] (0x0100): Principal name is: [PERF-IMGLAB08$(a)CONCORDIA.CA] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [ldap_child_get_tgt_sync] (0x0100): Using keytab [MEMORY:/etc/krb5.keytab] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.911434: Getting initial credentials for PERF-IMGLAB08$(a)CONCORDIA.CA (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.911637: Looked up etypes in keytab: des-cbc-crc, des, des-cbc-crc, rc4-hmac, aes128-cts, aes256-cts (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.911713: Sending request (195 bytes) to CONCORDIA.CA (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.911787: Resolving hostname Int-con-dc-1.concordia.ca (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.914393: Sending initial UDP request to dgram 132.205.123.21:88 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.915860: Received answer (210 bytes) from dgram 132.205.123.21:88 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.918866: Response was not from master KDC (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.918976: Received error from KDC: -1765328359/Additional pre-authentication required (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.919054: Processing preauth types: 16, 15, 19, 2 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.919087: Selected etype info: etype aes256-cts, salt "CONCORDIA.CAhostperf-imglab08.concordia.ca", params "" (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.919141: Retrieving PERF-IMGLAB08$(a)CONCORDIA.CA from MEMORY:/etc/krb5.keytab (vno 0, enctype aes256-cts) with result: 0/Success (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.919180: AS key obtained for encrypted timestamp: aes256-cts/FC36 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.919280: Encrypted timestamp (for 1484778188.973670): plain 301AA011180F32303137303131383232323330385AA10502030EDB66, encrypted D33317E3C9292ABF582F8D1E389DF6A3B5FFABFC7E0420B45A45B610EFD80E1D9C19CE9AAE0D7959B44E0773747AC7B0DCB56C9DFBF97DA3 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.919315: Preauth module encrypted_timestamp (2) (real) returned: 0/Success (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.919337: Produced preauth for next request: 2 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.919431: Sending request (275 bytes) to CONCORDIA.CA (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.919472: Resolving hostname Int-con-dc-1.concordia.ca (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.921847: Sending initial UDP request to dgram 132.205.123.21:88 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.924168: Received answer (96 bytes) from dgram 132.205.123.21:88 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.927183: Response was not from master KDC (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.927216: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.927222: Request or response is too big for UDP; retrying with TCP (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.927227: Sending request (275 bytes) to CONCORDIA.CA (tcp only) (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.927234: Resolving hostname Int-con-dc-1.concordia.ca (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.928427: Initiating TCP connection to stream 132.205.123.21:88 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.929201: Sending TCP request to stream 132.205.123.21:88 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.931067: Received answer (1508 bytes) from stream 132.205.123.21:88 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.931080: Terminating TCP connection to stream 132.205.123.21:88 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.932326: Response was not from master KDC (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.932365: Processing preauth types: 19 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.932374: Selected etype info: etype aes256-cts, salt "CONCORDIA.CAhostperf-imglab08.concordia.ca", params "" (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.932380: Produced preauth for next request: (empty) (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.932387: AS key determined by preauth: aes256-cts/FC36 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.932409: Decrypted AS reply; session key is: aes256-cts/C509 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.932415: FAST negotiation: unavailable (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [ldap_child_get_tgt_sync] (0x2000): credentials initialized (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [ldap_child_get_tgt_sync] (0x2000): keytab ccname: [FILE:/var/lib/sss/db/ccache_CONCORDIA.CA_BHwy1c] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.932442: Initializing FILE:/var/lib/sss/db/ccache_CONCORDIA.CA_BHwy1c with default princ PERF-IMGLAB08$(a)CONCORDIA.CA (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [sss_child_krb5_trace_cb] (0x4000): [25874] 1484778188.932486: Storing PERF-IMGLAB08$(a)CONCORDIA.CA -> krbtgt/CONCORDIA.CA(a)CONCORDIA.CA in FILE:/var/lib/sss/db/ccache_CONCORDIA.CA_BHwy1c (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [ldap_child_get_tgt_sync] (0x2000): credentials stored (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [ldap_child_get_tgt_sync] (0x2000): Got KDC time offset (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [ldap_child_get_tgt_sync] (0x2000): Renaming [/var/lib/sss/db/ccache_CONCORDIA.CA_BHwy1c] to [/var/lib/sss/db/ccache_CONCORDIA.CA] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [unique_filename_destructor] (0x2000): Unlinking [/var/lib/sss/db/ccache_CONCORDIA.CA_BHwy1c] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [unlink_dbg] (0x2000): File already removed: [/var/lib/sss/db/ccache_CONCORDIA.CA_BHwy1c] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [prepare_response] (0x0400): Building response for result [0] (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [pack_buffer] (0x2000): response size: 60 (Wed Jan 18 17:23:08 2017) [[sssd[ldap_child[25874]]]] [pack_buffer] (0x1000): result [0] krberr [0] msgsize [40] msg [FILE:/var/lib/sss/db/ccache_CONCORDIA.CA] Any help would be greatly appreciated, I've been trying to solve this problem over the last 2 weeks to no success. Thanks! Thomas

3 11

SSSD and nested AD domains
by smfrench＠gmail.com 20 Feb '17

20 Feb '17

I haven't been able to find much useful information on how sssd (if at all) handles child domains in Active Directory. If you join an AD domain, presumably you can authenticate any users in the children domains, but what happens when you do "getent" do you expect to see users of the child domain reflected in the getent (since you are joined to the parent)? Do you expect to always be able to lookup users SIDs and UIDs from the children of the domains you joined? What about the parents?

2 1

RFC2307bis and partially configured Active Directory Domains
by smfrench＠gmail.com 19 Feb '17

19 Feb '17

One of the more common cases for sssd (or winbind) with RFC2307 seems to be getting uids/gids from Active Directory domains, but few Active Directories have all of their users/groups configured for the POSIX uid/gid. How can you configure sssd behavior for this common case (among the three behaviors that might be desired): 1) query AD for the Unix uid/gid and fail if that particular user is not configured with a uid (this seems to be what sss always does and isn't really practical given how unlikely that AD is configured perfectly for unix uids) 2) query AD for the Unix uid/gid and if that user is not configured with a uid map to a default uid (uid of something like "guest" or "defaultuser" or whatever) 3) query AD for the Unix uid/gid and if that user is not configured with a uid map algorithmically I didn't see much useful on this topic at https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/ht… If sssd doesn't do that, is this a case where winbind can do it better? or is there a way to configure nssswitch passwd line to fallback to a 3rd trivial alternative (files sss default e.g.) that provides a default uid for a user@domain who does not have a uid/gid configured in AD?

5 4

SSSD not reregister DDNS when interface goes up down
by Joakim Tjernlund 13 Feb '17

13 Feb '17

Starting up with eth0 plugged I gest DNS registered. But if I pull eth0 and enable WiFi I get a new IP but the old IP is still in DNS. Restarting sssd register the new WiFi IP. Bug or feature ? Jocke

3 4

libwbclient broken in sssd 1.15 ?
by Joakim Tjernlund 13 Feb '17

13 Feb '17

I can not get libwbclient in sssd 1.15 work at all for samba. samba log is not helpful either: [2017/02/11 20:08:47.742465, 1, pid=21157, effective(0, 0), real(0, 0)] ../source3/smbd/sesssetup.c:290(reply_sesssetup_and_X_spnego) Failed to generate session_info (user and group token) for session setup: NT_STATUS_LOGON_FAILURE Is libwbclient working in 1.15? Jocke

3 6

Notify If SSSD In Cache Mode
by Douglas Duckworth 11 Feb '17

11 Feb '17

Hello Is it possible to have SSSD notify users upon logging in that all LDAP servers are down and everything's being read from cache alone? Doug Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690

3 2

Re: Notify If SSSD In Cache Mode
by Douglas Duckworth 10 Feb '17

10 Feb '17

Thanks a lot Jakub. This is one of the best Linux listservs ever. Doug Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690 On Fri, Feb 10, 2017 at 9:00 AM, Jakub Hrozek <jhrozek(a)redhat.com> wrote: > On Fri, Feb 10, 2017 at 08:33:01AM -0500, Douglas Duckworth wrote: > > Hello > > > > Is it possible to have SSSD notify users upon logging in that all LDAP > > servers are down and everything's being read from cache alone? > > Yes, but this info is not printed by default, you need to increase the > pam_verbosity parameter, see man sssd.conf. The option belongs to the > [pam] section. > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org >

1 0

SSSD AD login fails in RHEL 6
by pavan.kumar21＠wipro.com 10 Feb '17

10 Feb '17

Hi Team, I am new member of this group and ofcourse this is my first post. :) I have configured SSSD manually by updating sssd.conf , smb.conf and krb5.conf. Used authconfig to update pam files and also manually done. System joins to domain but AD user login fails. while running sometimes i get error Kerberos pre-authentication failed ..sometimes its joined without error. But both times AD login fails. KRB5.CONF [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = TEST.COM dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true WIPRO.COM = { kdc = sss.test.com admin_server = sss.test.com } [domain_realm] .test.com = TEST.COMtest.com = TEST.COM SSSD.CONF config_file_version = 2 # Number of times services should attempt to reconnect in the # event of a crash or restart before they give up reconnection_retries = 3 # If a back end is particularly slow you can raise this timeout here sbus_timeout = 30 services = nss, pam # SSSD will not start if you do not configure any domains. # Add new domain configurations as [domain/<NAME>] sections, and # then add the list of domains (in the order you want them to be # queried) to the "domains" attribute below and uncomment it. domains = TEST.COM #domains = LOCAL [domain/TETS.COM] id_provider = ad access_provider = ad ldap_schema = ad override_homedir = /home/%d/%u ldap_id_mapping = false [nss] # The following prevents SSSD from searching for the root user/group in # all domains (you can add here a comma-separated list of system accounts that # are always going to be /etc/passwd users, or that you want to filter out). filter_groups = root filter_users = root reconnection_retries = 3 entry_cache_timeout = 300 entry_cache_nowait_percentage = 75 # The entry_cache_nowait_percentage indicates the percentage of the # entry_cache_timeout to wait before updating the cache out-of-band. # (NSS requests will still be returned from cache until the full # entry_cache_timeout). Setting this value to 0 turns this feature # off (default). ; entry_cache_nowait_percentage = 300 [pam] reconnection_retries = 3 offline_credentials_expiration = 2 offline_failed_login_attempts = 3 offline_failed_login_delay = 5 SMB.CONF [global] #--authconfig--start-line-- # Generated by authconfig on 2017/02/07 12:37:55 # DO NOT EDIT THIS SECTION (delimited by --start-line--/--end-line--) # Any modification may be deleted or altered by authconfig in future workgroup = TETS password server = * realm = TEST.COM security = ads idmap config * : range = 16777216-33554431 template shell = /bin/bash winbind use default domain = false winbind offline logon = false As part of troubleshooting ,i have tried with sssd debug mode etc. Major error message i get is related to Kerberos.Hope this forum gives me success. Regards Pavan

3 3

account not authenticating in child domain
by sonia.gilbert＠hawaiianair.com 09 Feb '17

09 Feb '17

Server is joined to abc.com and authentication is working to abc.com. A child domain was created a.abc.com but authentication is not working to the child domain. sssd.conf [root@server01 sssd]# more /etc/sssd/sssd.conf [sssd] domains = abc.com config_file_version = 2 services = nss, pam [domain/abc.com] id_provider = ad access_provider = simple realmd_tags = manages-system joined-with-samba ad_domain = abc.com ad_server = dc01.abc.com,dc02.abc.com,_srv_ krb5_realm = ABC.COM default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = False fallback_homedir = /home/%u@%d simple_allow_groups = TDI Remote Access Users(a)abc.com debug_level = 0x07F0 [domain/a.abc.com] ad_server = sdc01.a.abc.com,sdc02.a.abc.com,_srv_ From krb5 log: (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.682973: Getting initial credentials for 017978\@a.abc.com@abc.com (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.683157: Sending request (217 bytes) to abc.com (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.683431: Sending initial UDP request to dgram x.x.161.251:88 (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746482: Received answer (129 bytes) from dgram x.x.161.251:88 (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746600: Response was from master KDC (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746660: Received error from KDC: -1765328316/Realm not local to KDC (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746708: Following referral to realm a.abc.com (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746788: Sending request (233 bytes) to a.abc.com (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.878092: Resolving hostname infsdcpci01.a.abc.com. (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.943098: Sending initial UDP request to dgram x.x.166.251:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.13629: Received answer (219 bytes) from dgram x.x.166.251:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.77982: Response was not from master KDC (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.78076: Received error from KDC: -1765328359/Additional pre-authentication required (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.78145: Processing preauth types: 16, 15, 19, 2 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.78192: Selected etype info: etype aes256-cts, salt "a.abc.com017978", params "" (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97413: AS key obtained for encrypted timestamp: aes256-cts/ED73 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97516: Encrypted timestamp (for 1485291543.976086): plain 301AA011180F32303137303132343230353930335AA10502030EE4D6, encrypted C7492B7309B4456330A7EE35DACBF67592D8573801102A3AB633823BE64F94EA7B1726E96F5EDAD9213AD0726D9CF89B214E96B1EB03B5AB (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97559: Preauth module encrypted_timestamp (2) (real) returned: 0/Success (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97583: Produced preauth for next request: 2 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97621: Sending request (313 bytes) to a.abc.com (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.230488: Resolving hostname infsdcpci02.a.abc.com. (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.297013: Sending initial UDP request to dgram x.x.166.252:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.366557: Received answer (186 bytes) from dgram x.x.166.252:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.428891: Response was not from master KDC (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.428975: Received error from KDC: -1765328360/Preauthentication failed (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429029: Preauth tryagain input types: 16, 15, 19, 2 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429068: Retrying AS request with master KDC (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429096: Getting initial credentials for 017978\@a.abc.com@abc.com (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429189: Sending request (217 bytes) to abc.com (master) (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429275: Sending initial UDP request to dgram x.x.161.251:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494276: Received answer (129 bytes) from dgram x.x.161.251:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494363: Received error from KDC: -1765328316/Realm not local to KDC (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494397: Following referral to realm a.abc.com (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494467: Sending request (233 bytes) to a.abc.com (master) (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [get_and_save_tgt] (0x0020): 1234: [-1765328360][Preauthentication failed] (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [map_krb5_error] (0x0020): 1303: [-1765328360][Preauthentication failed] (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [k5c_send_data] (0x0200): Received error code 1432158215 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [pack_response_packet] (0x2000): response packet size: [4] (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [k5c_send_data] (0x4000): Response sent. (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [main] (0x0400): krb5_child completed successfully (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.682973: Getting initial credentials for 017978\@a.abc.com@abc.com (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.683157: Sending request (217 bytes) to abc.com (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.683431: Sending initial UDP request to dgram x.x.161.251:88 (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746482: Received answer (129 bytes) from dgram x.x.161.251:88 (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746600: Response was from master KDC (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746660: Received error from KDC: -1765328316/Realm not local to KDC (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746708: Following referral to realm a.abc.com (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746788: Sending request (233 bytes) to a.abc.com (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.878092: Resolving hostname infsdcpci01.a.abc.com. (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.943098: Sending initial UDP request to dgram x.x.166.251:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.13629: Received answer (219 bytes) from dgram x.x.166.251:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.77982: Response was not from master KDC (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.78076: Received error from KDC: -1765328359/Additional pre-authentication required (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.78145: Processing preauth types: 16, 15, 19, 2 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.78192: Selected etype info: etype aes256-cts, salt "a.abc.com017978", params "" (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97413: AS key obtained for encrypted timestamp: aes256-cts/ED73 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97516: Encrypted timestamp (for 1485291543.976086): plain 301AA011180F32303137303132343230353930335AA10502030EE4D6, encrypted C7492B7309B4456330A7EE35DACBF67592D8573801102A3AB633823BE64F94EA7B1726E96F5EDAD9213AD0726D9CF89B214E96B1EB03B5AB (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97559: Preauth module encrypted_timestamp (2) (real) returned: 0/Success (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97583: Produced preauth for next request: 2 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97621: Sending request (313 bytes) to a.abc.com (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.230488: Resolving hostname infsdcpci02.a.abc.com. (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.297013: Sending initial UDP request to dgram x.x.166.252:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.366557: Received answer (186 bytes) from dgram x.x.166.252:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.428891: Response was not from master KDC (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.428975: Received error from KDC: -1765328360/Preauthentication failed (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429029: Preauth tryagain input types: 16, 15, 19, 2 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429068: Retrying AS request with master KDC (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429096: Getting initial credentials for 017978\@a.abc.com@abc.com (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429189: Sending request (217 bytes) to abc.com (master) (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429275: Sending initial UDP request to dgram x.x.161.251:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494276: Received answer (129 bytes) from dgram x.x.161.251:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494363: Received error from KDC: -1765328316/Realm not local to KDC (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494397: Following referral to realm a.abc.com (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494467: Sending request (233 bytes) to a.abc.com (master) (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [get_and_save_tgt] (0x0020): 1234: [-1765328360][Preauthentication failed] (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [map_krb5_error] (0x0020): 1303: [-1765328360][Preauthentication failed] (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [k5c_send_data] (0x0200): Received error code 1432158215 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [pack_response_packet] (0x2000): response packet size: [4] (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [k5c_send_data] (0x4000): Response sent. (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [main] (0x0400): krb5_child completed successfully From sssd domain log: (Tue Jan 24 13:59:18 2017) [sssd[be[a.hawaiian.aero]]] [be_req_set_domain] (0x0400): Changing request domain from [abc.com] to [a.abc.com] (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [be_pam_handler] (0x0100): Got request with the following data (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): domain: a.abc.com (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): user: 017978(a)a.abc.com (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): service: conwrks (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): tty: (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): ruser: (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): rhost: (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): authtok type: 1 (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): newauthtok type: 0 (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): priv: 1 (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): cli_pid: 13206 (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): logon name: not set (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [krb5_auth_queue_send] (0x1000): Wait queue of user [017978(a)a.abc.com] is empty, running request [0x7f1aae523b70] immediately. (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [krb5_setup] (0x4000): No mapping for: 017978(a)a.abc.com (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x7f1aae525c60 (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x7f1aae4e49f0 (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [ldb] (0x4000): Running timer event 0x7f1aae525c60 "ltdb_callback" (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [ldb] (0x4000): Destroying timer event 0x7f1aae4e49f0 "ltdb_timeout" (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [ldb] (0x4000): Ending timer event 0x7f1aae525c60 "ltdb_callback" (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [krb5_auth_send] (0x0100): Home directory for user [017978(a)a.abc.com] not known. (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [get_server_status] (0x1000): Status of server 'dc01.abc.com' is 'working' (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'dc01.abc.com' is 'working' (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 6 seconds (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [get_server_status] (0x1000): Status of server 'dc01.abc.com' is 'working' (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [be_resolve_server_process] (0x0200): Found address for server dc01.abc.com: [x.x.161.251] TTL 3600 (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [child_handler_setup] (0x2000): Setting up signal handler up for pid [25955] (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [child_handler_setup] (0x2000): Signal handler set up for pid [25955] (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [write_pipe_handler] (0x0400): All data has been sent! (Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [child_sig_handler] (0x1000): Waiting for child [25955]. (Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [child_sig_handler] (0x0100): child [25955] finished successfully. (Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [read_pipe_handler] (0x0400): EOF received, client finished (Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [check_wait_queue] (0x1000): Wait queue for user [017978(a)a.abc.com] is empty. (Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [krb5_auth_queue_done] (0x1000): krb5_auth_queue request [0x7f1aae523b70] done. (Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 17, <NULL>) [Success (Failure setting user credentials)] (Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [be_pam_handler_callback] (0x0100): Sending result [17][a.abc.com] (Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [be_pam_handler_callback] (0x0100): Sent result [17][a.abc.com]

7 17

SSSD and backup/restore after system failure
by smfrench＠gmail.com 03 Feb '17

03 Feb '17

In a scenario in which an sssd node joined to Active Directory crashed and had to be rebuilt, restoring key files from backup, other than the obvious files in /etc (for krb5, sssd, nss etc.) are there other sssd/krb5 persistent databases (/var/lib/sss/db ?) that would have to be restored (ctdb already handles Samba related databases like secrets.tdb) in order to recover a system after failure. What sssd files (if any) other than those in /etc directory would be required to restore a system that is joined to an AD domain after failure?

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users February 2017