Re: [SSSD-users] startup problem/port status 0

[Longina Przybyszewska]

Hi,
My machine joined AD - I can get attributes with ldapsearch as aduser (and as local
root):

alongina@victoria:~$ ldapsearch  -E pr=1000/noprompt -H ldap://nat.c.sdu.dk -Y GSSAPI  -b
'ou=Linux computers,ou=ADResources,dc=nat,dc=c,dc=sdu,dc=dk'
'(&(objectClass=computer)(name=victoria))'
SASL/GSSAPI authentication started
SASL username: alongina(a)NAT.C.SDU.DK
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <ou=Linux computers,ou=ADResources,dc=nat,dc=c,dc=sdu,dc=dk> with scope
subtree
# filter: (&(objectClass=computer)(name=victoria))
# requesting: ALL
# with pagedResults control: size=1000
#

# VICTORIA, Linux computers, ADResources, nat.c.sdu.dk
dn: CN=VICTORIA,OU=Linux computers,OU=ADResources,DC=nat,DC=c,DC=sdu,DC=dk
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
cn: VICTORIA
distinguishedName: CN=VICTORIA,OU=Linux computers,OU=ADResources,DC=nat,DC=c,D
 C=sdu,DC=dk
instanceType: 4
whenCreated: 20121107151527.0Z
whenChanged: 20121108100744.0Z
uSNCreated: 22665166
uSNChanged: 22700883
name: VICTORIA
objectGUID:: Np8rYg/Jxka041fkPw1blA==
userAccountControl: 4096
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 129967763011945002
lastLogoff: 0
lastLogon: 129968428368941751
localPolicyFlags: 0
pwdLastSet: 129968428370191767
primaryGroupID: 515
objectSid:: AQUAAAAAAAUVAAAANYoCGg16WjOCi6YoUC4AAA==
accountExpires: 9223372036854775807
logonCount: 1
sAMAccountName: VICTORIA$
sAMAccountType: 805306369
dNSHostName: victoria.nat.c.sdu.dk
servicePrincipalName: host/victoria.nat.c.sdu.dk
servicePrincipalName: host/victoria
objectCategory: CN=Computer,CN=Schema,CN=Configuration,DC=c,DC=sdu,DC=dk
isCriticalSystemObject: FALSE
dSCorePropagationData: 16010101000000.0Z
lastLogonTimestamp: 129968428370187304
msDS-SupportedEncryptionTypes: 28

# search result
search: 4
result: 0 Success
control: 1.2.840.113556.1.4.319 false MIQAAAAFAgEABAA=
pagedresults: cookie=

# numResponses: 2
# numEntries: 1


The /etc/krb5.keytab :
alongina@victoria:~$ sudo klist -e -k
[sudo] password for alongina: 
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   7 victoria$(a)NAT.C.SDU.DK (arcfour-hmac) 
   7 victoria$(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 
   7 victoria$(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96) 
   7 host/victoria(a)NAT.C.SDU.DK (arcfour-hmac) 
   7 host/victoria(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 
   7 host/victoria(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96) 
   7 host/victoria.nat.c.sdu.dk(a)NAT.C.SDU.DK (arcfour-hmac) 
   7 host/victoria.nat.c.sdu.dk(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 
   7 host/victoria.nat.c.sdu.dk(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96)  

Does it make difference victoria$<-->VICTORIA$ ???
Because in AD :
sSAMAccountName VICTORIA$

I can't make kinit using keytab:

alongina@victoria:~$ kinit -k -t /etc/krb5.keytab victoria$(a)NAT.C.SDU.DK
kinit: Client not found in Kerberos database while getting initial credentials
alongina@victoria:~$ kinit -k -t /etc/krb5.keytab host/victoria(a)NAT.C.SDU.DK
kinit: Client not found in Kerberos database while getting initial credentials
alongina@victoria:~$ kinit -k -t /etc/krb5.keytab victoria$
kinit: Generic preauthentication failure while getting initial credentials
alongina@victoria:~$ kinit -k -t /etc/krb5.keytab 'victoria$'
kinit: Generic preauthentication failure while getting initial credentials

I use msktutils for joining AD
Longina 

-----Original Message-----
From: sssd-users-bounces(a)lists.fedorahosted.org
[mailto:[e-mail]] On Behalf Of Jakub Hrozek
Sent: 8. november 2012 10:54
To: sssd-users(a)lists.fedorahosted.org
Subject: Re: [SSSD-users] startup problem/port status 0

On Tue, Nov 06, 2012 at 02:16:26PM +0000, Longina Przybyszewska wrote:
>  Hi again,
>  Thanks a lot for guiding me so far :)
>  
>  I have got sssd-1.9.2 package from Timo, Ubuntu sssd package maintainer for  Ubuntu
> Quantal.
>  
>  SSSD is configured against  AD as auth/id - provider
>  
>  sssd.conf
>  
>  [sssd]
>  debug_level = 0x1310
>  config_file_version = 2
>  services = nss, pam
>  domains = nat.c.sdu.dk
>  
>  [nss]
>  filter_groups = root
>  filter_users = root
>  
>  [pam]
>  
>  [domain/nat.c.sdu.dk]
>  
>  debug_level = 0x1310
>  
>  enumerate = False
>  min_id = 1000
>  max_id = 20000
>  
>  auth_provider = ad
>  id_provider = ad
>  access_provider = ad
>  chpass_provider = ad
>  
>  ad_server = nat.c.sdu.dk
>  ad_hostname = testina4$.nat.c.sdu.dk
>  ad_domain = nat.c.sdu.dk
>  
>  
>  From  log:
>  (Tue Nov  6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] 
>  [be_resolve_server_process] (0x1000): Saving the first resolved server 
>  (Tue Nov  6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] 
>  [be_resolve_server_process] (0x0200): Found address for server 
>  nat.c.sdu.dk: [10.144.5.18] TTL 455  (Tue Nov  6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]]
> [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: testina4$ (Tue Nov  6
> 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [fo_set_port_status] (0x0100): Marking port 0 of
> server 'nat.c.sdu.dk' as 'not working (Tue Nov  6 13:42:35 2012)
> [sssd[be[nat.c.sdu.dk]]] [fo_resolve_service_send] (0x0100): Trying to resolve service
> 'AD'
>  (Tue Nov  6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [get_server_status] (0x1000): Status
> of server 'nat.c.sdu.dk' is 'name resolved'
>  (Tue Nov  6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [get_port_status] (0x1000): Port
> status of port 0 for server 'nat.c.sdu.dk' is 'not working'
>  (Tue Nov  6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] 
>  [be_resolve_server_done] (0x1000): Server resolution failed: 5 (Tue 
>  Nov  6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [acctinfo_callback] 
>  (0x0100): Request processed. Returned 1,11,Offline (Tue Nov  6 
>  13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [remove_krb5_info_files] 
>  (0x0200): Could not remove 
>  [/var/lib/sss/pubconf/kpasswdinfo.NAT.C.SDU.DK], [2][No such file or 
>  directory
>  
>  
There is not all the information in the log, raising the debug_level might provide more
info, but I think the problem is in the kinit.

Can you kinit as the principal specified in the ad_hostname and then ldapsearch the
directory?

Are you sure about the principal in ad_hostname? I think it is typically HOST$@DOMAIN,
your principal doesn't contain the at-sign.
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users