Hello!
I am looking at some errors that I have been seeing in some logs specific to but not limited to RHEL/CentOS 7.x 8.x and Rocky 8.x (SSSD version - sssd-2.4.0-9.el8_4.1.x86_64). All systems are attached to a Windows Active Directory domain using 'adcli'.
The configuration works as expected and seems to see no major problems. Although it does cause some unnecessary noise in the logs. Which prompted me to look at it a little further.
All the logs show the errors that are happening. FYI: Servers are part of a forest and it does look like rdns = false.
Here are all the logs related to the error (If I am missing anything please let me know and I will add it in there ASAP! Some logs are compressed as it repeats itself over and over again.
****Command Used: journalctl -p 4****
Aug 10 10:28:33 EXAMPLE.CC.CC.NET sssd[ldap_child[2972536]][2972536]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. Aug 10 10:28:33 EXAMPLE.CC.CC.NET sssd[ldap_child[2972537]][2972537]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. Aug 10 10:28:33 EXAMPLE.CC.CC.NET sssd[ldap_child[2972538]][2972538]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. Aug 10 10:28:33 EXAMPLE.CC.CC.NET sssd[ldap_child[2972539]][2972539]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. Aug 10 10:28:33 EXAMPLE.CC.CC.NET sssd[ldap_child[2972540]][2972540]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection.
****Command Used: journalctl -u sssd****
Aug 09 14:28:32 EXAMPLE.CC.CC.NET sssd[3906155]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database. Aug 09 14:28:32 EXAMPLE.CC.CC.NET sssd[3906155]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database. Aug 09 14:28:32 EXAMPLE.CC.CC.NET sssd[3906155]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database. Aug 09 14:28:32 EXAMPLE.CC.CC.NET sssd[3906155]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database. Aug 09 14:40:52 EXAMPLE.CC.CC.NET adcli[2526663]: GSSAPI client step 1 Aug 09 14:40:52 EXAMPLE.CC.CC.NET adcli[2526663]: GSSAPI client step 1 Aug 09 14:40:52 EXAMPLE.CC.CC.NET adcli[2526663]: GSSAPI client step 1
****KEYTAB****
Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 2 MYSERVER$@EXAMPLE.DOMAIN.COM 2 MYSERVER$@EXAMPLE.DOMAIN.COM 2 host/MYSERVER@EXAMPLE.DOMAIN.COM 2 host/MYSERVER@EXAMPLE.DOMAIN.COM 2 host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM 2 host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM 2 RestrictedKrbHost/MYSERVER@EXAMPLE.DOMAIN.COM 2 RestrictedKrbHost/MYSERVER@EXAMPLE.DOMAIN.COM 2 RestrictedKrbHost/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM 2 RestrictedKrbHost/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM
****KRB5_CHILD.LOG****
(2021-08-10 13:59:37): [krb5_child[3051214]] [sss_send_pac] (0x0040): sss_pac_make_request failed [-1][2]. (2021-08-10 13:59:37): [krb5_child[3051214]] [validate_tgt] (0x0040): sss_send_pac failed, group membership for user with principal [someuser1@ EXAMPLE.DOMAIN.COM@EXAMPLE.DOMAIN.COM] might not be correct. (2021-08-10 14:24:43): [krb5_child[3061023]] [sss_send_pac] (0x0040): sss_pac_make_request failed [-1][2]. (2021-08-10 14:24:43): [krb5_child[3061023]] [validate_tgt] (0x0040): sss_send_pac failed, group membership for user with principal [someuser1@ EXAMPLE.DOMAIN.COM@EXAMPLE.DOMAIN.COM] might not be correct.
****LDAP_CHILD.LOG****
(2021-08-10 14:28:33): [ldap_child[3063821]] [ldap_child_get_tgt_sync] (0x0040): krb5_get_init_creds_keytab() failed: -1765328378 (2021-08-10 14:28:33): [ldap_child[3063821]] [ldap_child_get_tgt_sync] (0x0010): Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. (2021-08-10 14:28:33): [ldap_child[3063821]] [main] (0x0020): ldap_child_get_tgt_sync failed. (2021-08-10 14:28:33): [ldap_child[3063822]] [ldap_child_get_tgt_sync] (0x0040): krb5_get_init_creds_keytab() failed: -1765328378 (2021-08-10 14:28:33): [ldap_child[3063822]] [ldap_child_get_tgt_sync] (0x0010): Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. (2021-08-10 14:28:33): [ldap_child[3063822]] [main] (0x0020): ldap_child_get_tgt_sync failed.
****SSSD.CONF****
[sssd] domains = EXAMPLE.domain.com config_file_version = 2 services = nss, pam
[domain/EXAMPLE.domain.com] ad_domain = EXAMPLE.domain.com ad_enable_gc = false krb5_realm = EXAMPLE.DOMAIN.COM krb5_lifetime = 10h subdomain_inherit = ignore_group_members, ldap_purge_cache_timeout ignore_group_members = true ldap_purge_cache_timeout = 0 realmd_tags = joined-with-adcli, manages-system cache_credentials = false id_provider = ad krb5_store_password_if_offline = true default_shell = /bin/bash ldap_id_mapping = true ldap_sasl_authid = MYSERVER$@EXAMPLE.DOMAIN.COM ldap_use_tokengroups = true use_fully_qualified_names = false fallback_homedir = /home/%d/%u access_provider = simple Simple_allow_groups = linux_admins simple_allow_users = someuser1, someuser2, someuser3
Thank you so much for your help!
Am Tue, Aug 10, 2021 at 03:49:34PM -0400 schrieb Jovan Quinones-Morales:
Hello!
I am looking at some errors that I have been seeing in some logs specific to but not limited to RHEL/CentOS 7.x 8.x and Rocky 8.x (SSSD version
- sssd-2.4.0-9.el8_4.1.x86_64). All systems are attached to a Windows
Active Directory domain using 'adcli'.
The configuration works as expected and seems to see no major problems. Although it does cause some unnecessary noise in the logs. Which prompted me to look at it a little further.
All the logs show the errors that are happening. FYI: Servers are part of a forest and it does look like rdns = false.
Here are all the logs related to the error (If I am missing anything please let me know and I will add it in there ASAP! Some logs are compressed as it repeats itself over and over again.
****Command Used: journalctl -p 4****
Aug 10 10:28:33 EXAMPLE.CC.CC.NET sssd[ldap_child[2972536]][2972536]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. Aug 10 10:28:33 EXAMPLE.CC.CC.NET sssd[ldap_child[2972537]][2972537]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. Aug 10 10:28:33 EXAMPLE.CC.CC.NET sssd[ldap_child[2972538]][2972538]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. Aug 10 10:28:33 EXAMPLE.CC.CC.NET sssd[ldap_child[2972539]][2972539]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. Aug 10 10:28:33 EXAMPLE.CC.CC.NET sssd[ldap_child[2972540]][2972540]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection.
Hi,
currently I have no idea what makes ldap_child requesting a ticket for 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM'. The default for the AD provider would be 'MYSERVER$@EXAMPLE.DOMAIN.COM' which you also set explicitly with the ldap_sasl_authid option.
Can you send the full domain logs as well? This might help to identify what 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' is used.
****Command Used: journalctl -u sssd****
Aug 09 14:28:32 EXAMPLE.CC.CC.NET sssd[3906155]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database. Aug 09 14:28:32 EXAMPLE.CC.CC.NET sssd[3906155]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database. Aug 09 14:28:32 EXAMPLE.CC.CC.NET sssd[3906155]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database. Aug 09 14:28:32 EXAMPLE.CC.CC.NET sssd[3906155]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database. Aug 09 14:40:52 EXAMPLE.CC.CC.NET adcli[2526663]: GSSAPI client step 1 Aug 09 14:40:52 EXAMPLE.CC.CC.NET adcli[2526663]: GSSAPI client step 1 Aug 09 14:40:52 EXAMPLE.CC.CC.NET adcli[2526663]: GSSAPI client step 1
****KEYTAB****
Keytab name: FILE:/etc/krb5.keytab KVNO Principal
2 MYSERVER$@EXAMPLE.DOMAIN.COM 2 MYSERVER$@EXAMPLE.DOMAIN.COM 2 host/MYSERVER@EXAMPLE.DOMAIN.COM 2 host/MYSERVER@EXAMPLE.DOMAIN.COM 2 host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM 2 host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM 2 RestrictedKrbHost/MYSERVER@EXAMPLE.DOMAIN.COM 2 RestrictedKrbHost/MYSERVER@EXAMPLE.DOMAIN.COM 2 RestrictedKrbHost/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM 2 RestrictedKrbHost/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM
****KRB5_CHILD.LOG****
(2021-08-10 13:59:37): [krb5_child[3051214]] [sss_send_pac] (0x0040): sss_pac_make_request failed [-1][2]. (2021-08-10 13:59:37): [krb5_child[3051214]] [validate_tgt] (0x0040): sss_send_pac failed, group membership for user with principal [someuser1@ EXAMPLE.DOMAIN.COM@EXAMPLE.DOMAIN.COM] might not be correct. (2021-08-10 14:24:43): [krb5_child[3061023]] [sss_send_pac] (0x0040): sss_pac_make_request failed [-1][2]. (2021-08-10 14:24:43): [krb5_child[3061023]] [validate_tgt] (0x0040): sss_send_pac failed, group membership for user with principal [someuser1@ EXAMPLE.DOMAIN.COM@EXAMPLE.DOMAIN.COM] might not be correct.
Most probably the PAC responder is not running. It is not enabled by default with the AD provide because there are other means to determine group-memberships as well. If you add 'pac' to the 'services' option in sssd.conf this message should go away. But you can ignore this message as well, iirc we increased the debug level for this messages in more recent versions of SSSD.
HTH
bye, Sumit
****LDAP_CHILD.LOG****
(2021-08-10 14:28:33): [ldap_child[3063821]] [ldap_child_get_tgt_sync] (0x0040): krb5_get_init_creds_keytab() failed: -1765328378 (2021-08-10 14:28:33): [ldap_child[3063821]] [ldap_child_get_tgt_sync] (0x0010): Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. (2021-08-10 14:28:33): [ldap_child[3063821]] [main] (0x0020): ldap_child_get_tgt_sync failed. (2021-08-10 14:28:33): [ldap_child[3063822]] [ldap_child_get_tgt_sync] (0x0040): krb5_get_init_creds_keytab() failed: -1765328378 (2021-08-10 14:28:33): [ldap_child[3063822]] [ldap_child_get_tgt_sync] (0x0010): Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. (2021-08-10 14:28:33): [ldap_child[3063822]] [main] (0x0020): ldap_child_get_tgt_sync failed.
****SSSD.CONF****
[sssd] domains = EXAMPLE.domain.com config_file_version = 2 services = nss, pam
[domain/EXAMPLE.domain.com] ad_domain = EXAMPLE.domain.com ad_enable_gc = false krb5_realm = EXAMPLE.DOMAIN.COM krb5_lifetime = 10h subdomain_inherit = ignore_group_members, ldap_purge_cache_timeout ignore_group_members = true ldap_purge_cache_timeout = 0 realmd_tags = joined-with-adcli, manages-system cache_credentials = false id_provider = ad krb5_store_password_if_offline = true default_shell = /bin/bash ldap_id_mapping = true ldap_sasl_authid = MYSERVER$@EXAMPLE.DOMAIN.COM ldap_use_tokengroups = true use_fully_qualified_names = false fallback_homedir = /home/%d/%u access_provider = simple Simple_allow_groups = linux_admins simple_allow_users = someuser1, someuser2, someuser3
Thank you so much for your help!
-- *Jovan Quinones-Morales* Linux Operating Systems Analyst VCU Infrastructure Services https://www.ucc.vcu.edu/ Technology Services Department 804.828.4810 quinonesmoj@vcu.edu
https://adminmicro2.questionpro.com/?t_340030260=Jovan%20Quinones-Morales&u_65977055=351791134 *Don't be a phishing victim -- VCU and other reputable organisations will never use email to request that you reply with your password, social security number or confidential personal information. For more details, visit **https://ts.vcu.edu/about-us/information-security/common-questions/what-is-ph... https://ts.vcu.edu/about-us/information-security/common-questions/what-is-phishing*
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
Hello!
I put the pac option in the sssd config which seemed to help in the logs and in the long run. Although taking a look at the domain logs I have this. The main issue with "Server not found in kerberos databse" was remediated by setting dyndns_update = false being that we are not using dyndns.
Here are the logs when dyndns is set to false.
***DOMAIN LOGS***
(2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [orderly_shutdown] (0x0010): SIGTERM: killing children (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [orderly_shutdown] (0x0040): Shutting down (status = 0)(2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [server_setup] (0x0040): Starting with debug level = 0x0070 (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [sdap_cli_connect_recv] (0x0040): Unable to establish connection [13]: Permission denied (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [sdap_cli_connect_recv] (0x0040): Unable to establish connection [13]: Permission denied (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [sdap_cli_connect_recv] (0x0040): Unable to establish connection [13]: Permission denied (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [sdap_cli_connect_recv] (0x0040): Unable to establish connection [13]: Permission denied (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [sdap_cli_connect_recv] (0x0040): Unable to establish connection [13]: Permission denied (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [fo_resolve_service_send] (0x0020): No available servers for service 'sd_domain.com' (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [ad_get_slave_domain_connect_done] (0x0020): Unable to connect to LDAP [5]: Input/output error (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [ad_subdomains_refresh_done] (0x0040): Unable to get subdomains [5]: Input/output error (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [be_ptask_done] (0x0040): Task [Subdomains Refresh]: failed with [5]: Input/output error (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [ad_get_slave_domain_connect_done] (0x0020): Unable to connect to LDAP [5]: Input/output error (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [ad_subdomains_refresh_done] (0x0040): Unable to get subdomains [5]: Input/output error
***LDAP_CHILD LOGS***
(2021-08-12 10:17:35): [ldap_child[4054178]] [ldap_child_get_tgt_sync] (0x2000): got realm_name: [EXAMPLE.DOMAIN.COM] (2021-08-12 10:17:35): [ldap_child[4054178]] [ldap_child_get_tgt_sync] (0x0100): Principal name is: [MYSERVER$@EXAMPLE.DOMAIN.COM] (2021-08-12 10:17:35): [ldap_child[4054178]] [ldap_child_get_tgt_sync] (0x0100): Using keytab [MEMORY:/etc/krb5.keytab] (2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018940: Getting initial credentials for MYSERVER$@EXAMPLE.DOMAIN.COM
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018941: Unrecognized enctype name in default_tkt_enctypes: des-cbc-crc
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018942: Unrecognized enctype name in default_tkt_enctypes: des-cbc-md5
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018943: Looked up etypes in keytab: rc4-hmac, aes256-cts
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018945: Sending unauthenticated request
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018946: Sending request (205 bytes) to EXAMPLE.DOMAIN.COM
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018947: Sending initial UDP request to dgram 192.172.2.5:88
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018948: Received answer (228 bytes) from dgram 192.172.2.5:88
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018949: Response was from master KDC
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018950: Received error from KDC: -1765328359/Additional pre-authentication required
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018953: Preauthenticating using KDC method data
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018954: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2)
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018955: Selected etype info: etype aes256-cts, salt "EXAMPLE.DOMAIN.COMhostmyserver.example.domain.com", params ""
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018956: Retrieving MYSERVER$@EXAMPLE.DOMAIN.COM from MEMORY:/etc/krb5.keytab (vno 0, enctype aes256-cts) with result: 0/Success
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018957: AS key obtained for encrypted timestamp: aes256-cts/D0B6
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018959: Encrypted timestamp (for 1628777855.139844): plain 301AA011180F32303231303831323134313733355AA1050203022244, encrypted 7E3F423BDB4DC1D927079C7D0E47E4AF671FC5255391F8812547A862034C5F3BEF53F551A9544A3BB7CE65201DF22772A9B0A3A2440ED2E2
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018960: Preauth module encrypted_timestamp (2) (real) returned: 0/Success
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018961: Produced preauth for next request: PA-ENC-TIMESTAMP (2)
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018962: Sending request (285 bytes) to EXAMPLE.DOMAIN.COM
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018963: Sending initial UDP request to dgram 192.172.2.5:88
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018964: Received answer (104 bytes) from dgram 192.172.2.5:88
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018965: Response was from master KDC
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018966: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018967: Request or response is too big for UDP; retrying with TCP
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018968: Sending request (285 bytes) to EXAMPLE.DOMAIN.COM (tcp only)
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018969: Initiating TCP connection to stream 192.172.2.5:88 (2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018970: Sending TCP request to stream 192.172.2.5:88
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018971: Received answer (1627 bytes) from stream 192.172.2.5:88
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018972: Terminating TCP connection to stream 192.172.2.5:88
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018973: Response was from master KDC
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018974: Processing preauth types: PA-ETYPE-INFO2 (19)
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018975: Selected etype info: etype aes256-cts, salt "EXAMPLE.DOMAIN.COMhostmyserver.example.domain.com", params ""
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018976: Produced preauth for next request: (empty)
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018977: AS key determined by preauth: aes256-cts/D0B6
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018978: Decrypted AS reply; session key is: aes256-cts/D18C
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018979: FAST negotiation: unavailable
(2021-08-12 10:17:35): [ldap_child[4054178]] [ldap_child_get_tgt_sync] (0x2000): credentials initialized (2021-08-12 10:17:35): [ldap_child[4054178]] [ldap_child_get_tgt_sync] (0x2000): keytab ccname: [FILE:/var/lib/sss/db/ccache_EXAMPLE.DOMAIN.COM_mgQNA9] (2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018980: Initializing FILE:/var/lib/sss/db/ccache_EXAMPLE.DOMAIN.COM_mgQNA9 with default princ MYSERVER$@EXAMPLE.DOMAIN.COM
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018981: Storing MYSERVER$@EXAMPLE.DOMAIN.COM -> krbtgt/EXAMPLE.DOMAIN.COM@EXAMPLE.DOMAIN.COM in FILE:/var/lib/sss/db/ccache_EXAMPLE.DOMAIN.COM_mgQNA9
(2021-08-12 10:17:35): [ldap_child[4054178]] [ldap_child_get_tgt_sync] (0x2000): credentials stored (2021-08-12 10:17:35): [ldap_child[4054178]] [ldap_child_get_tgt_sync] (0x2000): Got KDC time offset (2021-08-12 10:17:35): [ldap_child[4054178]] [ldap_child_get_tgt_sync] (0x2000): Renaming [/var/lib/sss/db/ccache_EXAMPLE.DOMAIN.COM_mgQNA9] to [/var/lib/sss/db/ccache_EXAMPLE.DOMAIN.COM] (2021-08-12 10:17:35): [ldap_child[4054178]] [unique_filename_destructor] (0x2000): Unlinking [/var/lib/sss/db/ccache_EXAMPLE.DOMAIN.COM_mgQNA9] (2021-08-12 10:17:35): [ldap_child[4054178]] [unlink_dbg] (0x2000): File already removed: [/var/lib/sss/db/ccache_EXAMPLE.DOMAIN.COM_mgQNA9] (2021-08-12 10:17:35): [ldap_child[4054178]] [prepare_response] (0x0400): Building response for result [0] (2021-08-12 10:17:35): [ldap_child[4054178]] [pack_buffer] (0x2000): response size: 64 (2021-08-12 10:17:35): [ldap_child[4054178]] [pack_buffer] (0x1000): result [0] krberr [0] msgsize [44] msg [FILE:/var/lib/sss/db/ccache_EXAMPLE.DOMAIN.COM] (2021-08-12 10:17:35): [ldap_child[4054178]] [main] (0x0400): ldap_child completed successfully
(2021-08-12 10:32:12): [ldap_child[4057811]] [main] (0x0020): ldap_child_get_tgt_sync failed. (2021-08-12 10:32:12): [ldap_child[4057812]] [ldap_child_get_tgt_sync] (0x0040): krb5_get_init_creds_keytab() failed: -1765328378 (2021-08-12 10:32:12): [ldap_child[4057812]] [ldap_child_get_tgt_sync] (0x0010): Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. (2021-08-12 10:32:12): [ldap_child[4057812]] [main] (0x0020): ldap_child_get_tgt_sync failed.
Thank you!
Jovan
Am Thu, Aug 12, 2021 at 02:55:17PM -0000 schrieb Jovan Quinones-Morales:
Hello!
I put the pac option in the sssd config which seemed to help in the logs and in the long run. Although taking a look at the domain logs I have this. The main issue with "Server not found in kerberos databse" was remediated by setting dyndns_update = false being that we are not using dyndns.
Here are the logs when dyndns is set to false.
***DOMAIN LOGS***
(2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [orderly_shutdown] (0x0010): SIGTERM: killing children (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [orderly_shutdown] (0x0040): Shutting down (status = 0)(2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [server_setup] (0x0040): Starting with debug level = 0x0070 (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [sdap_cli_connect_recv] (0x0040): Unable to establish connection [13]: Permission denied (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [sdap_cli_connect_recv] (0x0040): Unable to establish connection [13]: Permission denied (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [sdap_cli_connect_recv] (0x0040): Unable to establish connection [13]: Permission denied (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [sdap_cli_connect_recv] (0x0040): Unable to establish connection [13]: Permission denied (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [sdap_cli_connect_recv] (0x0040): Unable to establish connection [13]: Permission denied (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [fo_resolve_service_send] (0x0020): No available servers for service 'sd_domain.com' (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [ad_get_slave_domain_connect_done] (0x0020): Unable to connect to LDAP [5]: Input/output error (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [ad_subdomains_refresh_done] (0x0040): Unable to get subdomains [5]: Input/output error (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [be_ptask_done] (0x0040): Task [Subdomains Refresh]: failed with [5]: Input/output error (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [ad_get_slave_domain_connect_done] (0x0020): Unable to connect to LDAP [5]: Input/output error (2021-08-12 10:32:12): [be[EXAMPLE.domain.com]] [ad_subdomains_refresh_done] (0x0040): Unable to get subdomains [5]: Input/output error
Hi,
can you run SSSD with 'debug_level = 9' in the [domain/...] section for this case as well? For dyndns SSSD should reuse the Kerberos credentials used for the LDAP connection.
bye, Sumit
***LDAP_CHILD LOGS***
(2021-08-12 10:17:35): [ldap_child[4054178]] [ldap_child_get_tgt_sync] (0x2000): got realm_name: [EXAMPLE.DOMAIN.COM] (2021-08-12 10:17:35): [ldap_child[4054178]] [ldap_child_get_tgt_sync] (0x0100): Principal name is: [MYSERVER$@EXAMPLE.DOMAIN.COM] (2021-08-12 10:17:35): [ldap_child[4054178]] [ldap_child_get_tgt_sync] (0x0100): Using keytab [MEMORY:/etc/krb5.keytab] (2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018940: Getting initial credentials for MYSERVER$@EXAMPLE.DOMAIN.COM
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018941: Unrecognized enctype name in default_tkt_enctypes: des-cbc-crc
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018942: Unrecognized enctype name in default_tkt_enctypes: des-cbc-md5
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018943: Looked up etypes in keytab: rc4-hmac, aes256-cts
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018945: Sending unauthenticated request
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018946: Sending request (205 bytes) to EXAMPLE.DOMAIN.COM
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018947: Sending initial UDP request to dgram 192.172.2.5:88
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018948: Received answer (228 bytes) from dgram 192.172.2.5:88
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018949: Response was from master KDC
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018950: Received error from KDC: -1765328359/Additional pre-authentication required
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018953: Preauthenticating using KDC method data
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018954: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2)
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018955: Selected etype info: etype aes256-cts, salt "EXAMPLE.DOMAIN.COMhostmyserver.example.domain.com", params ""
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018956: Retrieving MYSERVER$@EXAMPLE.DOMAIN.COM from MEMORY:/etc/krb5.keytab (vno 0, enctype aes256-cts) with result: 0/Success
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018957: AS key obtained for encrypted timestamp: aes256-cts/D0B6
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018959: Encrypted timestamp (for 1628777855.139844): plain 301AA011180F32303231303831323134313733355AA1050203022244, encrypted 7E3F423BDB4DC1D927079C7D0E47E4AF671FC5255391F8812547A862034C5F3BEF53F551A9544A3BB7CE65201DF22772A9B0A3A2440ED2E2
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018960: Preauth module encrypted_timestamp (2) (real) returned: 0/Success
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018961: Produced preauth for next request: PA-ENC-TIMESTAMP (2)
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018962: Sending request (285 bytes) to EXAMPLE.DOMAIN.COM
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018963: Sending initial UDP request to dgram 192.172.2.5:88
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018964: Received answer (104 bytes) from dgram 192.172.2.5:88
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018965: Response was from master KDC
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018966: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018967: Request or response is too big for UDP; retrying with TCP
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018968: Sending request (285 bytes) to EXAMPLE.DOMAIN.COM (tcp only)
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018969: Initiating TCP connection to stream 192.172.2.5:88 (2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018970: Sending TCP request to stream 192.172.2.5:88
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018971: Received answer (1627 bytes) from stream 192.172.2.5:88
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018972: Terminating TCP connection to stream 192.172.2.5:88
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018973: Response was from master KDC
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018974: Processing preauth types: PA-ETYPE-INFO2 (19)
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018975: Selected etype info: etype aes256-cts, salt "EXAMPLE.DOMAIN.COMhostmyserver.example.domain.com", params ""
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018976: Produced preauth for next request: (empty)
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018977: AS key determined by preauth: aes256-cts/D0B6
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018978: Decrypted AS reply; session key is: aes256-cts/D18C
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018979: FAST negotiation: unavailable
(2021-08-12 10:17:35): [ldap_child[4054178]] [ldap_child_get_tgt_sync] (0x2000): credentials initialized (2021-08-12 10:17:35): [ldap_child[4054178]] [ldap_child_get_tgt_sync] (0x2000): keytab ccname: [FILE:/var/lib/sss/db/ccache_EXAMPLE.DOMAIN.COM_mgQNA9] (2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018980: Initializing FILE:/var/lib/sss/db/ccache_EXAMPLE.DOMAIN.COM_mgQNA9 with default princ MYSERVER$@EXAMPLE.DOMAIN.COM
(2021-08-12 10:17:35): [ldap_child[4054178]] [sss_child_krb5_trace_cb] (0x4000): [4054178] 1628777855.018981: Storing MYSERVER$@EXAMPLE.DOMAIN.COM -> krbtgt/EXAMPLE.DOMAIN.COM@EXAMPLE.DOMAIN.COM in FILE:/var/lib/sss/db/ccache_EXAMPLE.DOMAIN.COM_mgQNA9
(2021-08-12 10:17:35): [ldap_child[4054178]] [ldap_child_get_tgt_sync] (0x2000): credentials stored (2021-08-12 10:17:35): [ldap_child[4054178]] [ldap_child_get_tgt_sync] (0x2000): Got KDC time offset (2021-08-12 10:17:35): [ldap_child[4054178]] [ldap_child_get_tgt_sync] (0x2000): Renaming [/var/lib/sss/db/ccache_EXAMPLE.DOMAIN.COM_mgQNA9] to [/var/lib/sss/db/ccache_EXAMPLE.DOMAIN.COM] (2021-08-12 10:17:35): [ldap_child[4054178]] [unique_filename_destructor] (0x2000): Unlinking [/var/lib/sss/db/ccache_EXAMPLE.DOMAIN.COM_mgQNA9] (2021-08-12 10:17:35): [ldap_child[4054178]] [unlink_dbg] (0x2000): File already removed: [/var/lib/sss/db/ccache_EXAMPLE.DOMAIN.COM_mgQNA9] (2021-08-12 10:17:35): [ldap_child[4054178]] [prepare_response] (0x0400): Building response for result [0] (2021-08-12 10:17:35): [ldap_child[4054178]] [pack_buffer] (0x2000): response size: 64 (2021-08-12 10:17:35): [ldap_child[4054178]] [pack_buffer] (0x1000): result [0] krberr [0] msgsize [44] msg [FILE:/var/lib/sss/db/ccache_EXAMPLE.DOMAIN.COM] (2021-08-12 10:17:35): [ldap_child[4054178]] [main] (0x0400): ldap_child completed successfully
(2021-08-12 10:32:12): [ldap_child[4057811]] [main] (0x0020): ldap_child_get_tgt_sync failed. (2021-08-12 10:32:12): [ldap_child[4057812]] [ldap_child_get_tgt_sync] (0x0040): krb5_get_init_creds_keytab() failed: -1765328378 (2021-08-12 10:32:12): [ldap_child[4057812]] [ldap_child_get_tgt_sync] (0x0010): Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/EXAMPLE.CC.CC.NET@EXAMPLE.DOMAIN.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. (2021-08-12 10:32:12): [ldap_child[4057812]] [main] (0x0020): ldap_child_get_tgt_sync failed.
Thank you!
Jovan _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
sssd-users@lists.fedorahosted.org
-
Jovan Quinones-Morales -
Sumit Bose