SSSD Service cannot start: Someone deleted /etc/sssd/sssd.conf and /etc/krb5.keytab from RHEL 7 server

[Turritopsis Dohrnii Teo En Ming]

Subject: SSSD Service cannot start: Someone deleted
/etc/sssd/sssd.conf and /etc/krb5.keytab from RHEL 7 server

Good day from Singapore,

Today 22 Jun 2022 Wednesday, I discovered that someone deleted
/etc/sssd/sssd.conf and /etc/krb5.keytab from one of the Red Hat
Enterprise Linux (RHEL) 7 servers. Hence System Security Services
Daemon (SSSD) cannot start.

I have solved it by copying /etc/sssd/sssd.conf from another RHEL 7
server and generating kerberos keytab file on the Active Directory
Domain Controller Windows Server.

Here is an edited sample of our /etc/sssd/sssd.conf file.

[sssd]
domains = project.domain.com
config_file_version = 2
services = nss, pam

[domain/project.domain.com]
ad_server = addc01.project.domain.com
ad_domain = project.domain.com
krb5_realm = PROJECT.DOMAIN.COM
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u%d
access_provider = ad

The 2 Windows Server commands I used to create a kerberos keytab are:

[1] setspn -A host/rhel7.project.domain.com rhel7

[2] ktpass /princ host/rhel7.project.domain.com(a)PROJECT.DOMAIN.COM
/out rhel7.keytab /crypto All /ptype KRB5_NT_PRINCIPAL -desonly
/mapuser PROJECT\rhel7$ +setupn +rndPass +setpass +answer

After generating rhel7.keytab on the Active Directory Domain
Controller Windows Server, copy the keytab file to the target RHEL 7
server as /etc/krb5.keytab.

As we do not have direct SSH access to the target RHEL 7 server, I
have to copy out rhel7.keytab from the Windows Server using winscp.
Then I use winscp again to upload rhel7.keytab to another intermediate
RHEL 7 server. From the intermediate RHEL 7 server, I used the
following Linux command to transfer rhel7.keytab to the target RHEL 7
server.

$ scp rhel7.keytab user@<IP address of target RHEL 7
server>:/home/user/rhel7.keytab

On the target RHEL 7 server, run the following Linux commands:

$ sudo cp rhel7.keytab /etc/krb5.keytab

Then

$ su -

# systemctl start sssd.service

# systemctl status sssd.service

I have solved the problem!

Reference Guides
================

[1] 22.8.1 Configuring an SSSD Server
Link: https://docs.oracle.com/cd/E37670_01/E41138/html/ch22s08s01.html

[2] How to create a kerberos keytab on Active Directory for Red Hat
Enterprise Linux
Link: https://access.redhat.com/solutions/208173

Regards,

Mr. Turritopsis Dohrnii Teo En Ming
Targeted Individual in Singapore
22 Jun 2022 Wednesday
Blogs:
https://tdtemcerts.blogspot.com/
https://tdtemcerts.wordpress.com/