debugging sssd / autofs problem

[Thomas Beaudry]

Hi,


I have sssd + autofs working properly on 20+ machines.  Recently, 1 of those machine has
been not functioning properly (it might be linked to a power failure).  Essentially, after
any user logs into the machine, they get a:  .bashrc:  permission denied


I thought that this could have been linked to a corrupt cache, so i deleted everything in
my /var/lib/sss/db folder and restarted sssd.  This didn't fix my problem.?


Does anyone else have some suggestions as to what i can try?  My logs are very large
(6.5GB), so i could post them. but maybe there aren't necessary since maybe someone
knows what the problem is.


Thanks!

Thomas

[Thomas Beaudry]

?Hi,


I forgot to mention that after a user logs in and get a permission denied, if i do: 
klist,  there is no kerebos ticket.


Thomas

________________________________
From: Thomas Beaudry
Sent: Tuesday, October 10, 2017 10:13 AM
To: sssd-users(a)lists.fedorahosted.org
Subject: debugging sssd / autofs problem


Hi,


I have sssd + autofs working properly on 20+ machines.  Recently, 1 of those machine has
been not functioning properly (it might be linked to a power failure).  Essentially, after
any user logs into the machine, they get a:  .bashrc:  permission denied


I thought that this could have been linked to a corrupt cache, so i deleted everything in
my /var/lib/sss/db folder and restarted sssd.  This didn't fix my problem.?


Does anyone else have some suggestions as to what i can try?  My logs are very large
(6.5GB), so i could post them. but maybe there aren't necessary since maybe someone
knows what the problem is.


Thanks!

Thomas

[Lukas Slebodnik]

On (10/10/17 14:14), Thomas Beaudry wrote:
> ?Hi,
>
>
> I forgot to mention that after a user logs in and get a permission denied, if i do: 
> klist,  there is no kerebos ticket.
>
>
> Thomas
>
> ________________________________
> From: Thomas Beaudry
> Sent: Tuesday, October 10, 2017 10:13 AM
> To: sssd-users(a)lists.fedorahosted.org
> Subject: debugging sssd / autofs problem
>
>
> Hi,
>
>
> I have sssd + autofs working properly on 20+ machines.  Recently, 1 of those machine has
> been not functioning properly (it might be linked to a power failure).  Essentially, after
> any user logs into the machine, they get a:  .bashrc:  permission denied
>
>
> I thought that this could have been linked to a corrupt cache, so i deleted everything in
> my /var/lib/sss/db folder and restarted sssd.  This didn't fix my problem.?
>
>
> Does anyone else have some suggestions as to what i can try?  My logs are very large
> (6.5GB), so i could post them. but maybe there aren't necessary since maybe someone
> knows what the problem is.
>  
Some debugging info is described on page
https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html

Your log is really huge. How old is it?
Maybe it will help if you remove/truncate log files and restart sssd.

And I would expect some error in domain log file. sssd_autofs is
quite stable.

BTW I sometime filter most critical messages files with simple grep
  grep -nE "\(0x00[1-9]0\)" var/log/sssd/sssd_default.log
And then I try to find first relevant error in log file and check
previous lines.

HTH

LS

[Thomas Beaudry]

Hi Again,


User feedback indicates that my kerberos tickets are being destroyed, since they
aren't showing up when they type klist even though they were created 30 minutes ago,
and set to expire in 10 hours.


Thomas

________________________________
From: Thomas Beaudry
Sent: Tuesday, October 10, 2017 10:14 AM
To: sssd-users(a)lists.fedorahosted.org
Subject: Re: debugging sssd / autofs problem


?Hi,


I forgot to mention that after a user logs in and get a permission denied, if i do: 
klist,  there is no kerebos ticket.


Thomas

________________________________
From: Thomas Beaudry
Sent: Tuesday, October 10, 2017 10:13 AM
To: sssd-users(a)lists.fedorahosted.org
Subject: debugging sssd / autofs problem


Hi,


I have sssd + autofs working properly on 20+ machines.  Recently, 1 of those machine has
been not functioning properly (it might be linked to a power failure).  Essentially, after
any user logs into the machine, they get a:  .bashrc:  permission denied


I thought that this could have been linked to a corrupt cache, so i deleted everything in
my /var/lib/sss/db folder and restarted sssd.  This didn't fix my problem.?


Does anyone else have some suggestions as to what i can try?  My logs are very large
(6.5GB), so i could post them. but maybe there aren't necessary since maybe someone
knows what the problem is.


Thanks!

Thomas

[Lukas Slebodnik]

On (10/10/17 20:18), Thomas Beaudry wrote:
> Hi Again,
>
>
> User feedback indicates that my kerberos tickets are being destroyed, since they
> aren't showing up when they type klist even though they were created 30 minutes ago,
> and set to expire in 10 hours.
>  
I am a little bit lost.
Do you have a problem with autofs that sssd does not provide maps
from LDAP server?

Or there is a problem with user authentication that you did not get a valid
ticket. It might happen when sssd is in offline mode and offline
authentication was used.

LS

[Thomas Beaudry]

Hi Lukas,

I'm sorry i wasn't clear enough, the problem has been evolving,  I no longer think
there is an issue with autofs

Essentially what is happening on 1 machine is that kerebos tickets are getting destroyed
before their expiration.  These tickets should be valid for 10 hours, but after 30+ mins,
when a user types klist, they don't see their ticket anymore.

Thomas
________________________________________
From: Lukas Slebodnik <lslebodn(a)redhat.com&gt;
Sent: Wednesday, October 11, 2017 7:24 AM
To: End-user discussions about the System Security Services Daemon
Subject: [SSSD-users] Re: debugging sssd / autofs problem

On (10/10/17 20:18), Thomas Beaudry wrote:
> Hi Again,
>
>
> User feedback indicates that my kerberos tickets are being destroyed, since they
> aren't showing up when they type klist even though they were created 30 minutes ago,
> and set to expire in 10 hours.
>  
I am a little bit lost.
Do you have a problem with autofs that sssd does not provide maps
from LDAP server?

Or there is a problem with user authentication that you did not get a valid
ticket. It might happen when sssd is in offline mode and offline
authentication was used.

LS
_______________________________________________
sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org

[Lukas Slebodnik]

On (11/10/17 14:44), Thomas Beaudry wrote:
> Hi Lukas,
>
> I'm sorry i wasn't clear enough, the problem has been evolving,  I no longer think
> there is an issue with autofs
>
> Essentially what is happening on 1 machine is that kerebos tickets are getting destroyed
> before their expiration.  These tickets should be valid for 10 hours, but after 30+ mins,
> when a user types klist, they don't see their ticket anymore.
>  
What type of kerberos ccache do you use?
FILE, DIR, KEYRING ...

Because sssd does not call equivalent to "kdestroy"
It can refresh krb5 ticket if it is online and option
krb5_renew_interval is configured
You can find more details in man sssd-krb5.

LS

[Thomas Beaudry]

Hi,

I am using FILE.  From my /etc/krb5.conf:   default_ccache_name = FILE:/tmp/krb5cc_%{uid}
I am also not using krb5_renew_interval.  Maybe someone else is causing these tickets to
be destroyed.

Thomas

________________________________________
From: Lukas Slebodnik <lslebodn(a)redhat.com&gt;
Sent: Wednesday, October 11, 2017 12:11 PM
To: End-user discussions about the System Security Services Daemon
Subject: [SSSD-users] Re: debugging sssd / autofs problem

On (11/10/17 14:44), Thomas Beaudry wrote:
> Hi Lukas,
>
> I'm sorry i wasn't clear enough, the problem has been evolving,  I no longer think
> there is an issue with autofs
>
> Essentially what is happening on 1 machine is that kerebos tickets are getting destroyed
> before their expiration.  These tickets should be valid for 10 hours, but after 30+ mins,
> when a user types klist, they don't see their ticket anymore.
>  
What type of kerberos ccache do you use?
FILE, DIR, KEYRING ...

Because sssd does not call equivalent to "kdestroy"
It can refresh krb5 ticket if it is online and option
krb5_renew_interval is configured
You can find more details in man sssd-krb5.

LS
_______________________________________________
sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org