Connection reset error when joining the domain
by Abhijit Tikekar
Hi,
We recently started facing this error on all new servers that need to be integrated with AD using SSSD. Every time “net ads join -k” command is issued, following error is returned:
“Failed to join domain: failed to lookup DC info for domain X.Y.LOCAL' over rpc: NT_STATUS_CONNECTION_RESET”. [ In the packet capture, we do see reset’s coming from DC]
This is also happening on servers already connected with AD. Same error, although since they already have established join, authentication continues to work. Also, noticed that after doing “net ads keytab create”, keytab file is no longer getting generated under /etc.
AD team has recently disabled SMB V1 completely on the domain controllers. Could that be somehow causing this? I tried setting “client max protocol = SMB3” in smb.conf but that didn’t help.
[ for " net ads keytab add" or " net ads keytab create" it now says:
Ignoring unknown parameter "client max protocol"]
How can I further troubleshoot this issue?
Thanks,
~ abhi
6 years, 10 months
GPO's not applying to Linux clients
by François MUTSHE
Hi, I've been searching on many forums to solve my issue but no luck, the GPO's "Allow log on through Remote Desktop Services" and "Deny log on through Remote Desktop Services" are working well on Windows clients but not on Linux.
I created a test OU where i moved my test computer in, allowed a specific user to log on through Remote Desktop Services, results: anybody can login via ssh on my test computer.
In sssd logs we can see that its not applying GPOS to the computer:
[ad_gpo_process_gpo_done] (0x0400): no applicable gpos found after dacl filtering
(Fri Jun 2 15:52:06 2017) [sssd[be[domain.tld]]] [sysdb_gpo_get_gpo_result_object] (0x4000): cn=gpos,cn=ad,cn=custom,cn=domain.tld,cn=sysdb
(Fri Jun 2 15:52:06 2017) [sssd[be[domain.tld]]] [sysdb_gpo_get_gpo_result_object] (0x4000): No GPO Result object.
(Fri Jun 2 15:52:06 2017) [sssd[be[domain.tld]]] [ad_gpo_access_done] (0x0400): GPO-based access control successful.
(Fri Jun 2 15:52:06 2017) [sssd[be[domain.tld]]] [ad_gpo_access_send] (0x0400): service systemd-user maps to Permitted
(Fri Jun 2 15:52:06 2017) [sssd[be[domain.tld]]] [ad_gpo_access_done] (0x0400): GPO-based access control successful.
What am i missing here? All GPOS have authenticated user default rights on it.
I attached my sssd.conf here.
Any help would be much appreciated
Regards, Mush.
6 years, 10 months
Re: p11_child fails to obtain certificate from yubikey
by Tallinn von Estonia
So here are the three logfiles as a gzipped tar-ball.
I did some cleanup for data protection purposes:
1. Where the certificate used was listed as a base64-encoded string I replaced it with ... and some trailing bytes of the string.2. I replaced the real realm and domain used with the word "realm" where the realm appeared in lowercase and "REALM" where the realm appeared in upper case. In sssd.conf the domain and the realm are the same and given in upper case.
The subject name of the certificate used for the tests was "CN=bernd, UID=<number>". Obviously one can't deduce the domain or realm of the user from the subject given in the certificate. The ldap-entry of the user does not contain the domain or the kerberos principal name either, the principal name is found as a subject alt name extension in the certificate only (which is included in the ldap-entry of the user).
I have probably have to change something here, may it be including the kerberos principal name in the ldap entry of the user or in the subject name of the certificate or some totally different kind of magic.
Thank you in advance for any help here.
Tallinn
6 years, 10 months
"net ads join" fails for one machine
by Abhijit Tikekar
Hi,
We are unable to connect one machine (CentOS 6.9) to Active Directory using SSSD. It is giving the following error whenever we attempt the join. Exact same settings are working for other servers.
# net ads join -k
Failed to join domain: failed to lookup DC info for domain X.Y.LOCAL' over rpc: NT_STATUS_CONNECTION_RESET
But testjoin shows OK.
# net ads testjoin
Join is OK
Even though join says OK, users are not able to authenticate
# net ads info
LDAP server: x.x.x.x
LDAP server name: AD-Server.x.y.local
Realm: X.Y.LOCAL
Bind Path: dc=X,dc=Y,dc=LOCAL
LDAP port: 389
Server time: Thu, 08 Jun 2017 11:18:41 EDT
KDC server: x.x.x.x
Server time offset: 0
“id” and “getent passwd <username>” return nothing.
DNS entries are correct under /etc/resolv.conf
Here is sanitized sssd_domain.log file (Log Level – 5)
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [be_res_get_opts] (0x0100): Lookup order: ipv4_first
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [recreate_ares_channel] (0x0100): Initializing new c-ares channel
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sysdb_domain_init_internal] (0x0200): DB File for x.y.local: /var/lib/sss/db/cache_x.y.local.ldb
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [monitor_common_send_id] (0x0100): Sending ID: (%BE_x.y.local,1)
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sss_names_init_from_args] (0x0100): Using re [(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))].
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sss_fqnames_init] (0x0100): Using fq format [%1$s@%2$s].
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_get_common_options] (0x0100): Setting ad_hostname to [hostname].
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_get_common_options] (0x0100): Setting domain option case_sensitive to [false]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [_ad_servers_init] (0x0100): Added failover server AD-Server.x.y.local
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_dyndns_init] (0x0100): Dynamic DNS updates are on. Checking for nsupdate..
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [be_nsupdate_timer_schedule] (0x0200): Scheduling timer in 86400 seconds
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_set_sdap_options] (0x0100): Option krb5_realm set to X.Y.LOCAL
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_sasl_options] (0x0100): Will look for hostname(a)X.Y.LOCAL in default keytab
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [select_principal_from_keytab] (0x0200): trying to select the most appropriate principal from keytab
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [select_principal_from_keytab] (0x0200): Selected primary: HOSTNAME$
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [select_principal_from_keytab] (0x0200): Selected realm: X.Y.LOCAL
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_sasl_options] (0x0100): Option ldap_sasl_authid set to HOSTNAME$
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_sasl_options] (0x0100): Option ldap_sasl_realm set to X.Y.LOCAL
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_set_search_bases] (0x0100): Search base not set. SSSD will attempt to discover it later, when connecting to the LDAP server.
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [common_parse_search_base] (0x0100): Search base added: [USER][dc=x,dc=y,dc=local][SUBTREE][]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [common_parse_search_base] (0x0100): Search base added: [GROUP][ou=Groups,ou=aaaa,ou=bbbb,ou=Company,dc=x,dc=y,dc=local][SUBTREE][]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_idmap_init] (0x0100): Initializing [5] domains for ID-mapping
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_machine_account_password_renewal_init] (0x0100): The helper program [/usr/sbin/adcli] for renewal doesn't exist [2]: No such file or directory
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_get_auth_options] (0x0100): Option krb5_server set to AD-Server.x.y.local
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_get_auth_options] (0x0100): Option krb5_realm set to X.Y.LOCAL
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_get_auth_options] (0x0100): Option krb5_use_kdcinfo set to true
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [check_and_export_lifetime] (0x0200): No lifetime configured.
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [check_and_export_lifetime] (0x0200): No lifetime configured.
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [check_and_export_options] (0x0100): No kpasswd server explicitly configured, using the KDC or defaults.
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [check_and_export_options] (0x0100): ccache is of type FILE
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [parse_krb5_map_user] (0x0200): Warning: krb5_map_user is empty!
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [load_backend_module] (0x0200): no module name found in confdb, using [ad].
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [common_parse_search_base] (0x0100): Search base added: [SUDO][ou=Global Groups,ou=Groups,ou=aaaa,ou=bbbb,ou=Company,dc=x,dc=y,dc=local][SUBTREE][]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [load_backend_module] (0x0200): no module name found in confdb, using [ad].
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [load_backend_module] (0x0200): no module name found in confdb, using [ad].
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [be_process_init] (0x0020): No selinux module provided for [x.y.local] !!
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [load_backend_module] (0x0200): no module name found in confdb, using [ad].
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [be_process_init] (0x0020): No host info module provided for [x.y.local] !!
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [load_backend_module] (0x0200): no module name found in confdb, using [ad].
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sss_write_krb5_localauth_snippet] (0x0200): File for localauth plugin configuration is [/var/lib/sss/pubconf/krb5.include.d/localauth_plugin]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sss_write_domain_mappings] (0x0200): Mapping file for domain [x.y.local] is [/var/lib/sss/pubconf/krb5.include.d/domain_realm_x_y_local]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_set_sdap_options] (0x0100): Option krb5_realm set to X.Y.LOCAL
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_sasl_options] (0x0100): Will look for hostname(a)X.Y.LOCAL in default keytab
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [select_principal_from_keytab] (0x0200): trying to select the most appropriate principal from keytab
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [select_principal_from_keytab] (0x0200): Selected primary: HOSTNAME$
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [select_principal_from_keytab] (0x0200): Selected realm: X.Y.LOCAL
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_sasl_options] (0x0100): Option ldap_sasl_authid set to HOSTNAME$
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_sasl_options] (0x0100): Option ldap_sasl_realm set to X.Y.LOCAL
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_failover_init] (0x0100): No primary servers defined, using service discovery
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [_ad_servers_init] (0x0100): Added service discovery for AD
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [fo_set_srv_lookup_plugin] (0x0080): SRV lookup plugin is already set
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [be_fo_set_srv_lookup_plugin] (0x0080): Unable to set SRV lookup plugin, another plugin may be already in place
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [dp_option_inherit] (0x0100): Option ldap_purge_cache_timeout is not set up to be inherited
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [dp_option_inherit] (0x0100): Option ldap_use_tokengroups is not set up to be inherited
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_set_sdap_options] (0x0100): Option krb5_realm set to X.Y.LOCAL
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_sasl_options] (0x0100): Will look for hostname(a)X.Y.LOCAL in default keytab
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [select_principal_from_keytab] (0x0200): trying to select the most appropriate principal from keytab
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [select_principal_from_keytab] (0x0200): Selected primary: HOSTNAME$
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [select_principal_from_keytab] (0x0200): Selected realm: X.Y.LOCAL
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_sasl_options] (0x0100): Option ldap_sasl_authid set to HOSTNAME$
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_sasl_options] (0x0100): Option ldap_sasl_realm set to X.Y.LOCAL
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_failover_init] (0x0100): No primary servers defined, using service discovery
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [_ad_servers_init] (0x0100): Added service discovery for AD
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [fo_set_srv_lookup_plugin] (0x0080): SRV lookup plugin is already set
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [be_fo_set_srv_lookup_plugin] (0x0080): Unable to set SRV lookup plugin, another plugin may be already in place
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [dp_option_inherit] (0x0100): Option ldap_purge_cache_timeout is not set up to be inherited
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [dp_option_inherit] (0x0100): Option ldap_use_tokengroups is not set up to be inherited
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_set_sdap_options] (0x0100): Option krb5_realm set to X.Y.LOCAL
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_sasl_options] (0x0100): Will look for hostname(a)X.Y.LOCAL in default keytab
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [select_principal_from_keytab] (0x0200): trying to select the most appropriate principal from keytab
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [select_principal_from_keytab] (0x0200): Selected primary: HOSTNAME$
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [select_principal_from_keytab] (0x0200): Selected realm: X.Y.LOCAL
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_sasl_options] (0x0100): Option ldap_sasl_authid set to HOSTNAME$
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_sasl_options] (0x0100): Option ldap_sasl_realm set to X.Y.LOCAL
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_failover_init] (0x0100): No primary servers defined, using service discovery
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [_ad_servers_init] (0x0100): Added service discovery for AD
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [fo_set_srv_lookup_plugin] (0x0080): SRV lookup plugin is already set
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [be_fo_set_srv_lookup_plugin] (0x0080): Unable to set SRV lookup plugin, another plugin may be already in place
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [dp_option_inherit] (0x0100): Option ldap_purge_cache_timeout is not set up to be inherited
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [dp_option_inherit] (0x0100): Option ldap_use_tokengroups is not set up to be inherited
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_set_sdap_options] (0x0100): Option krb5_realm set to X.Y.LOCAL
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_sasl_options] (0x0100): Will look for hostname(a)X.Y.LOCAL in default keytab
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [select_principal_from_keytab] (0x0200): trying to select the most appropriate principal from keytab
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [select_principal_from_keytab] (0x0200): Selected primary: HOSTNAME$
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [select_principal_from_keytab] (0x0200): Selected realm: X.Y.LOCAL
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_sasl_options] (0x0100): Option ldap_sasl_authid set to HOSTNAME$
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_sasl_options] (0x0100): Option ldap_sasl_realm set to X.Y.LOCAL
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_failover_init] (0x0100): No primary servers defined, using service discovery
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [_ad_servers_init] (0x0100): Added service discovery for AD
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [fo_set_srv_lookup_plugin] (0x0080): SRV lookup plugin is already set
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [be_fo_set_srv_lookup_plugin] (0x0080): Unable to set SRV lookup plugin, another plugin may be already in place
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [dp_option_inherit] (0x0100): Option ldap_purge_cache_timeout is not set up to be inherited
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [dp_option_inherit] (0x0100): Option ldap_use_tokengroups is not set up to be inherited
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [become_user] (0x0200): Trying to become user [0][0].
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [become_user] (0x0200): Already user [0].
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [id_callback] (0x0100): Got id ack and version (1) from Monitor
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sbus_server_init_new_connection] (0x0200): Entering.
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sbus_server_init_new_connection] (0x0200): Adding connection 0xbe6280.
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sbus_server_init_new_connection] (0x0200): Got a connection
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [be_client_init] (0x0100): Set-up Backend ID timeout [0xbe6b30]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sbus_server_init_new_connection] (0x0200): Entering.
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sbus_server_init_new_connection] (0x0200): Adding connection 0xbe8800.
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sbus_server_init_new_connection] (0x0200): Got a connection
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [be_client_init] (0x0100): Set-up Backend ID timeout [0xbe97f0]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [client_registration] (0x0100): Cancel DP ID timeout [0xbe6b30]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [client_registration] (0x0100): Added Frontend client [PAM]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve A record of 'AD-Server.x.y.local' in files
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [set_server_common_status] (0x0100): Marking server 'AD-Server.x.y.local' as 'resolving name'
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve AAAA record of 'AD-Server.x.y.local' in files
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [resolv_gethostbyname_next] (0x0200): No more address families to retry
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve A record of 'AD-Server.x.y.local' in DNS
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [set_server_common_status] (0x0100): Marking server 'AD-Server.x.y.local' as 'name resolved'
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [be_resolve_server_process] (0x0200): Found address for server AD-Server.x.y.local: [x.x.x.x] TTL 3600
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://AD-Server.x.y.local'
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://AD-Server.x.y.local'
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sbus_server_init_new_connection] (0x0200): Entering.
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sbus_server_init_new_connection] (0x0200): Adding connection 0xbec7b0.
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sbus_server_init_new_connection] (0x0200): Got a connection
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [be_client_init] (0x0100): Set-up Backend ID timeout [0xbee680]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [get_naming_context] (0x0200): Using value from [defaultNamingContext] as naming context.
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_search_base] (0x0100): Setting option [ldap_search_base] to [DC=x,DC=y,DC=local].
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [common_parse_search_base] (0x0100): Search base added: [DEFAULT][DC=x,DC=y,DC=local][SUBTREE][]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_search_base] (0x0100): Setting option [ldap_netgroup_search_base] to [DC=x,DC=y,DC=local].
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [common_parse_search_base] (0x0100): Search base added: [NETGROUP][DC=x,DC=y,DC=local][SUBTREE][]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_search_base] (0x0100): Setting option [ldap_service_search_base] to [DC=x,DC=y,DC=local].
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [common_parse_search_base] (0x0100): Search base added: [SERVICE][DC=x,DC=y,DC=local][SUBTREE][]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_set_search_base] (0x0100): Setting option [ldap_autofs_search_base] to [DC=x,DC=y,DC=local].
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [common_parse_search_base] (0x0100): Search base added: [AUTOFS][DC=x,DC=y,DC=local][SUBTREE][]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [6]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [be_resolve_server_process] (0x0200): Found address for server AD-Server.x.y.local: [x.x.x.x] TTL 3600
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [client_registration] (0x0100): Cancel DP ID timeout [0xbee680]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [client_registration] (0x0100): Added Frontend client [SUDO]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [child_sig_handler] (0x0100): child [14490] finished successfully.
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_kinit_done] (0x0100): Could not get TGT: 14 [Bad address]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_cli_connect_recv] (0x0040): Unable to establish connection [13]: Permission denied
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [fo_set_port_status] (0x0100): Marking port 0 of server 'AD-Server.x.y.local' as 'not working'
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [fo_resolve_service_send] (0x0020): No available servers for service 'AD'
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error])
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks.
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_subdomains_get_conn_done] (0x0080): No AD server is available, cannot get the subdomain list while offline
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [fo_resolve_service_send] (0x0020): No available servers for service 'AD'
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error])
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [be_ptask_enable] (0x0080): Task [Check if online (periodic)]: already enabled
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks.
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [ad_subdomains_get_conn_done] (0x0080): No AD server is available, cannot get the subdomain list while offline
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [client_registration] (0x0100): Cancel DP ID timeout [0xbe97f0]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [client_registration] (0x0100): Added Frontend client [NSS]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [remove_krb5_info_files] (0x0200): Could not remove [/var/lib/sss/pubconf/kpasswdinfo.X.Y.LOCAL], [2][No such file or directory]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [remove_krb5_info_files] (0x0200): Could not remove [/var/lib/sss/pubconf/kdcinfo.X.Y.LOCAL], [2][No such file or directory]
(Thu Jun 8 10:39:42 2017) [sssd[be[x.y.local]]] [remove_krb5_info_files] (0x0200): Could not remove [/var/lib/sss/pubconf/kpasswdinfo.X.Y.LOCAL], [2][No such file or directory]
(Thu Jun 8 10:40:00 2017) [sssd[be[x.y.local]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching.
(Thu Jun 8 10:40:01 2017) [sssd[be[x.y.local]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching.
(Thu Jun 8 10:40:01 2017) [sssd[be[x.y.local]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching.
(Thu Jun 8 10:40:01 2017) [sssd[be[x.y.local]]] [remove_krb5_info_files] (0x0200): Could not remove [/var/lib/sss/pubconf/kdcinfo.X.Y.LOCAL], [2][No such file or directory]
(Thu Jun 8 10:40:01 2017) [sssd[be[x.y.local]]] [remove_krb5_info_files] (0x0200): Could not remove [/var/lib/sss/pubconf/kpasswdinfo.X.Y.LOCAL], [2][No such file or directory]
Capture when net ads join fails. .66 is the ad server and .109 is the CentOS machine.
Sanitized contents of sssd.conf, krb5.conf and smb.conf
sssd.conf
[sssd]
domains = X.Y.LOCAL
services = nss, pam, sudo
config_file_version = 2
debug_level = 5
[nss]
[pam]
debug_level=5
[sudo]
debug_level=0
[domain/x.y.local]
debug_level=5
ad_server = AD-Server.x.y.local
id_provider = ad
auth_provider = ad
access_provider = ad
sudo_provider = ad
ldap_use_tokengroups = False
krb5_realm = X.Y.LOCAL
ldap_uri = ldap://AD-Server.x.y.local
ldap_sudo_search_base
ldap_user_search_base
ldap_group_search_base
ldap_access_order = filter, expire
ad_access_filter =
cache_credentials = true
override_homedir = /home/%d/%u
default_shell = /bin/bash
krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = X.Y.LOCAL
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = yes
[realms]
X.Y.LOCAL = {
kdc = AD-Server.x.y.local:88
admin_server = AD-Server.x.y.local:749
}
[domain_realm]
.x.y.local = X.Y.LOCAL
x.y.local = X.Y.LOCAL
smb.conf
[global]
workgroup = X
client signing = yes
client use spnego = yes
kerberos method = secrets and keytab
realm = X.Y.LOCAL
security = ads
log file = /var/log/samba/log.%m
max log size = 50
min protocol = SMB2
Thanks,
~ abhi
6 years, 10 months
p11_child fails to obtain certificate from yubikey
by tallinn1960＠yahoo.de
I am trying to setup a PKINIT/smartcard-based logon scheme using sssd 1.15.1 on Ubuntu 16.04. I am using the opensc-pkcs11 lib to access the smartcard. I have a working pam_krb5 based PKINIT smartcard logon to the KDC. The opensc pkcs11 lib and all relevant ca certificates are installed in the nss database.
However, p11_child is not happy about the yubikey:
➜ ~ sudo /usr/local/libexec/sssd/p11_child -d 9 --nssdb=/etc/pki/nssdb --pre
(Wed Apr 26 17:40:56:522588 2017) [[sssd[p11_child[2677]]]] [main] (0x0400): p11_child started.
(Wed Apr 26 17:40:56:522763 2017) [[sssd[p11_child[2677]]]] [main] (0x2000): Running in [pre-auth] mode.
(Wed Apr 26 17:40:56:522849 2017) [[sssd[p11_child[2677]]]] [main] (0x2000): Running with effective IDs: [0][0].
(Wed Apr 26 17:40:56:522931 2017) [[sssd[p11_child[2677]]]] [main] (0x2000): Running with real IDs [0][0].
(Wed Apr 26 17:40:56:655832 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): Default Module List:
(Wed Apr 26 17:40:56:655859 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): common name: [NSS Internal PKCS #11 Module].
(Wed Apr 26 17:40:56:655864 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): dll name: [(null)].
(Wed Apr 26 17:40:56:655869 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): common name: [yubikey].
(Wed Apr 26 17:40:56:655873 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): dll name: [/usr/lib/x86_64-linux-gnu/onepin-opensc-pkcs11.so].
(Wed Apr 26 17:40:56:655877 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): Dead Module List:
(Wed Apr 26 17:40:56:655883 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): DB Module List:
(Wed Apr 26 17:40:56:655888 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): common name: [NSS Internal Module].
(Wed Apr 26 17:40:56:655892 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): dll name: [(null)].
(Wed Apr 26 17:40:56:655917 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): Description [NSS Internal Cryptographic Services Mozilla Foundation ] Manufacturer [Mozilla Foundation ] flags [1].
(Wed Apr 26 17:40:56:655924 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): Description [NSS User Private Key and Certificate Services Mozilla Foundation ] Manufacturer [Mozilla Foundation ] flags [1].
(Wed Apr 26 17:40:56:655929 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): Description [Yubico Yubikey 4 OTP+CCID 00 00 OpenSC (www.opensc-project.org) ] Manufacturer [OpenSC (www.opensc-project.org) ] flags [7].
(Wed Apr 26 17:40:56:655940 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): Found [PIV_II (PIV Card Holder pin)] in slot [Yubico Yubikey 4 OTP+CCID 00 00][1] of module [2][/usr/lib/x86_64-linux-gnu/onepin-opensc-pkcs11.so].
(Wed Apr 26 17:40:56:655946 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): Token is NOT friendly.
(Wed Apr 26 17:40:56:655951 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): Trying to switch to friendly to read certificate.
(Wed Apr 26 17:40:56:655957 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): Login required.
(Wed Apr 26 17:40:56:655961 2017) [[sssd[p11_child[2677]]]] [do_work] (0x0020): Login required but no pin available, continue.
(Wed Apr 26 17:40:56:656102 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): found cert[PIV_II (PIV Card Holder pin):Certificate for PIV Authentication][CN=secadm,UID=4915377]
(Wed Apr 26 17:40:56:656127 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): Filtered certificates:
(Wed Apr 26 17:40:56:656132 2017) [[sssd[p11_child[2677]]]] [do_work] (0x4000): No certificate found.
It looks like the certificate on the key is PIN-protected. Shouldn't p11_child ask for a PIN? Giving p11_child the --pin flag has absolutely no effect.
Any help is welcome.
Thx
6 years, 10 months
sssd auto refresh of keytab entries?
by Joakim Tjernlund
Vi are seeing extra keytab entries in krb5.keytab here and there:
klist -k
....
11 host/GENTOO64(a)INFINERA.COM
12 host/GENTOO64(a)INFINERA.COM
...
I suspect sssd has added them, but why? and how?
Jocke
6 years, 10 months
