Hi,
We send the krb5_child.log attached as requested.
The test was an ssh usu7@adtest.xxx.xxx.xx(a)idmsrvpru.idmpru.xxx.xxx.xx from our IdM
server.
Hi,
thanks for the logs. The issue does not happen during Kerberos ticket
validation, as I thought but while trying to establish the FAST tunnel.
There should be two way to solve this. The first is setting
krb5_use_fast = never
in the [domain/...] section of sssd.conf on every IPA client. The second
is to reestablish the trust as two-way trust with the '--two-way=True'
option of 'ipa trust-add'. I would recommend the latter.
HTH
bye,
Sumit
Many thanks.
Lic. Mateo Duffour
Unidad Informática
2901.40.91
[
http://maps.apple.com/?q=18%20de%20julio%20985%20-%20Piso%204,Montevideo,... | 18
de julio 985 - Piso 3, Montevideo, Uruguay ]
[
http://www.fnr.gub.uy/ | ]
No me imprimas si no es necesario. Protejamos el medio ambiente. Este mensaje y la
información adjunta al mismo está dirigido exclusivamente a su destinatario. Puede
contener información confidencial, privilegiada o de uso restringido, protegida por las
normas. Si Ud. recibió este e-mail por error, por favor, sírvase notificarle a quien se lo
envió y borrar el original. Cualquier otro uso del e-mail por Ud. está prohibido.
----- Original Message -----
From: "Sumit Bose" <sbose(a)redhat.com>
To: "Mateo Duffour" <mduffour(a)fnr.gub.uy>
Cc: "Alexander Bokovoy" <abokovoy(a)redhat.com>, "Sumit Bose"
<sbose(a)redhat.com>, "freeipa-users"
<freeipa-users(a)lists.fedorahosted.org>, "tizo" <tizone(a)gmail.com>
Sent: Friday, 8 April, 2022 02:45:06
Subject: Re: [Freeipa-users] Re: IdM with trust relationship with Samba AD DC - User
accounts with passwords expired
Am Thu, Apr 07, 2022 at 05:07:00PM -0300 schrieb Mateo Duffour:
> Hi,
>
> The last answer that we received on bugzilla and on samba lists sais "Your
kpasswd is expecting FAST support which has been added in samba 4.16. So you either have
to disable FAST or upgrade first."
>
> We've upgraded our Samba server version to 4.16.0 and we're getting this
error now (when trying to login with any user from our IdM server):
>
> Apr 07 11:50:46 idmsrvpru.idmpru.xxx.xxx.xx krb5_child[4846]: Error constructing
AP-REQ armor: Server krbtgt/ADTEST.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx not found in Kerberos
database
> Apr 07 11:50:46 idmsrvpru.idmpru.xxx.xxx.xx krb5_child[4846]: Error constructing
AP-REQ armor: Server krbtgt/ADTEST.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx not found in Kerberos
database
Hi,
looks like there are issues requesting the cross-realm TGT, it would be
good to see the full krb5_child.log file with 'debug_level = 9' in the
[domain/...] section of sssd.conf to maybe better understand why this fails.
I would expect that the cross-realm TGT is requested during the
validation of the Kerberos ticket. You can disable the validation as a
workaround by adding
krb5_validate = false
in the [domain/...] section of sssd.conf, see man sssd-krb5 for details.
bye,
Sumit
> Apr 07 11:50:46 idmsrvpru.idmpru.xxx.xxx.xx sshd[4842]: pam_sss(sshd:auth):
authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.9.9.4
user=usu7(a)adtest.xxx.xxx.xx
> Apr 07 11:50:46 idmsrvpru.idmpru.xxx.xxx.xx sshd[4842]: pam_sss(sshd:auth): received
for user usu7(a)adtest.xxx.xxx.xx : 4 (System error)
> Apr 07 11:50:48 idmsrvpru.idmpru.xxx.xxx.xx sshd[4840]: error: PAM: Authentication
failure for usu7(a)adtest.xxx.xxx.xx from 10.9.9.4
>
> Any help is appreciated, regards.
>
> Lic. Mateo Duffour
> Unidad Informática
> 2901.40.91
>
> [
http://maps.apple.com/?q=18%20de%20julio%20985%20-%20Piso%204,Montevideo,... |
18 de julio 985 - Piso 3, Montevideo, Uruguay ]
> [
http://www.fnr.gub.uy/ | ]
>
>
>
> No me imprimas si no es necesario. Protejamos el medio ambiente. Este mensaje y la
información adjunta al mismo está dirigido exclusivamente a su destinatario. Puede
contener información confidencial, privilegiada o de uso restringido, protegida por las
normas. Si Ud. recibió este e-mail por error, por favor, sírvase notificarle a quien se lo
envió y borrar el original. Cualquier otro uso del e-mail por Ud. está prohibido.
>
>
> From: "Mateo Duffour" <mduffour(a)fnr.gub.uy>
> To: "Alexander Bokovoy" <abokovoy(a)redhat.com>
> Cc: "Sumit Bose" <sbose(a)redhat.com>, "freeipa-users"
<freeipa-users(a)lists.fedorahosted.org>, "tizo" <tizone(a)gmail.com>
> Sent: Friday, 11 March, 2022 15:49:31
> Subject: Re: [Freeipa-users] Re: IdM with trust relationship with Samba AD DC - User
accounts with passwords expired
>
> Hi,
>
> We are experiencing the same behavior on Samba AD DC 4.15.5, we are going to report
a bug on
bugzilla.samba.org as you suggested.
>
>
> Thanks again.
>
> Lic. Mateo Duffour
> Unidad Informática
> 2901.40.91
>
> [
http://maps.apple.com/?q=18%20de%20julio%20985%20-%20Piso%204,Montevideo,... |
18 de julio 985 - Piso 3, Montevideo, Uruguay ]
> [
http://www.fnr.gub.uy/ | ]
>
>
>
> No me imprimas si no es necesario. Protejamos el medio ambiente. Este mensaje y la
información adjunta al mismo está dirigido exclusivamente a su destinatario. Puede
contener información confidencial, privilegiada o de uso restringido, protegida por las
normas. Si Ud. recibió este e-mail por error, por favor, sírvase notificarle a quien se lo
envió y borrar el original. Cualquier otro uso del e-mail por Ud. está prohibido.
>
>
> From: "Alexander Bokovoy" <abokovoy(a)redhat.com>
> To: "Mateo Duffour" <mduffour(a)fnr.gub.uy>
> Cc: "Sumit Bose" <sbose(a)redhat.com>, "freeipa-users"
<freeipa-users(a)lists.fedorahosted.org>, "tizo" <tizone(a)gmail.com>
> Sent: Friday, 11 March, 2022 15:03:58
> Subject: Re: [Freeipa-users] Re: IdM with trust relationship with Samba AD DC - User
accounts with passwords expired
>
> On pe, 11 maalis 2022, Mateo Duffour wrote:
>
>
> Hi,
>
> We installed Samba AD DC from this repo [
>
https://samba.tranquil.it/redhat8/samba-4.14.10/ |
>
https://samba.tranquil.it/redhat8/samba-4.14.10/ ] Its running over
> Roky Linux and it's on a trust relationship with IdM.
>
>
>
> Thanks. So this is a build with embedded Heimdal Kerberos version and a
> relatively old one.
>
> This sounds like a bug worth opening Samba upstream. There is nothing
> specific to FreeIPA in this communication, though. What happens is that
> a Kerberos client (in this case kpasswd) attempts to change a password
> and fails when expecting a response on Kerberos level from Samba AD DC.
>
> It may be mix of expectations between kpasswd from MIT Kerberos (on
> Rocky) and Heimdal (embedded in Samba AD DC), but to fix it you'd need
> to talk to Samba AD developers.
>
> Please open a bug at
bugzilla.samba.org, attach this capture and
> kpasswd trace logs. Also please provide details to what Samba build is
> this in the bug report.
>
> Prior doing that, may be try an upgrade to Samba 4.15.5 which is
> available in the same repositories from Tranquil IT.
> (
https://samba.tranquil.it/redhat8/).
>
>
> BQ_BEGIN
>
>
> Regards,
>
> Lic. Mateo Duffour
> Unidad Informática
> 2901.40.91
>
> [
http://maps.apple.com/?q=18%20de%20julio%20985%20-%20Piso%204,Montevideo,... |
18 de julio 985 - Piso 3, Montevideo, Uruguay ]
> [
http://www.fnr.gub.uy/ | ]
>
>
>
> No me imprimas si no es necesario. Protejamos el medio ambiente. Este mensaje y la
información adjunta al mismo está dirigido exclusivamente a su destinatario. Puede
contener información confidencial, privilegiada o de uso restringido, protegida por las
normas. Si Ud. recibió este e-mail por error, por favor, sírvase notificarle a quien se lo
envió y borrar el original. Cualquier otro uso del e-mail por Ud. está prohibido.
>
>
> From: "Alexander Bokovoy" <abokovoy(a)redhat.com>
> To: "Mateo Duffour" <mduffour(a)fnr.gub.uy>
> Cc: "Sumit Bose" <sbose(a)redhat.com>, "freeipa-users"
<freeipa-users(a)lists.fedorahosted.org>, "tizo" <tizone(a)gmail.com>
> Sent: Friday, 11 March, 2022 14:07:58
> Subject: Re: [Freeipa-users] Re: IdM with trust relationship with Samba AD DC - User
accounts with passwords expired
>
> On pe, 11 maalis 2022, Mateo Duffour wrote:
>
>
> Hi,
>
> I've send the network capture attached, it was made with tcpdump in the
> IdM server to the Samba AD DC server, while trying to log in with ssh
> with user5.
>
>
>
> Hi,
>
> can you give more details about this Samba AD DC installation? What
> Samba version is that? How was it built?
>
>
>
>
> BQ_BEGIN
>
> Regards,
>
> Lic. Mateo Duffour
> Unidad Informática
> 2901.40.91
>
> [
http://maps.apple.com/?q=18%20de%20julio%20985%20-%20Piso%204,Montevideo,... |
18 de julio 985 - Piso 3, Montevideo, Uruguay ]
> [
http://www.fnr.gub.uy/ | ]
>
>
>
> No me imprimas si no es necesario. Protejamos el medio ambiente. Este mensaje y la
información adjunta al mismo está dirigido exclusivamente a su destinatario. Puede
contener información confidencial, privilegiada o de uso restringido, protegida por las
normas. Si Ud. recibió este e-mail por error, por favor, sírvase notificarle a quien se lo
envió y borrar el original. Cualquier otro uso del e-mail por Ud. está prohibido.
>
>
> From: "tizo" <tizone(a)gmail.com>
> To: "freeipa-users" <freeipa-users(a)lists.fedorahosted.org>
> Cc: "Mateo Duffour" <mduffour(a)fnr.gub.uy>, "Alexander
Bokovoy" <abokovoy(a)redhat.com>, "Sumit Bose" <sbose(a)redhat.com>
> Sent: Friday, 11 March, 2022 11:38:50
> Subject: Re: [Freeipa-users] Re: IdM with trust relationship with Samba AD DC - User
accounts with passwords expired
>
>
>
>
> Hi,
>
> this is still the same pattern. Would it be possible to get a network
> trace to better understand how the KDC reply looks like and what might
> not be as expected by libkrb5?
>
> Additionally, can you try to set the password for the user with the
> expired password with
>
> KRB5_TRACE=/dev/stdout kpasswd usu5@ADTEST.....
>
> and send the output?
>
> bye,
> Sumit
>
>
>
>
>
> Hi there. I work with Mateo. We are sending the network capture in some minutes, but
to get ahead I am sending the other test:
>
> # KRB5_TRACE=/dev/stdout kpasswd usu5(a)ADTEST.XXX.XXX.XX
> [47521] 1647008539.753136: Getting initial credentials for usu5(a)ADTEST.XXX.XXX.XX
> [47521] 1647008539.753137: FAST armor ccache: KCM:0:84390
> [47521] 1647008539.753138: Retrieving
host/idmsrvpru.idmpru.XXX.XXX.XX(a)IDMPRU.XXX.XXX.XX ->
krb5_ccache_conf_data/fast_avail/krbtgt\/ADTEST.XXX.XXX.XX\@ADTEST.XXX.XXX.XX(a)X-CACHECONF:
from KCM:0:84390 with result: -1765328243/Matching credential not found
> [47521] 1647008539.753139: Setting initial creds service to kadmin/changepw
> [47521] 1647008539.753140: FAST armor ccache: KCM:0:84390
> [47521] 1647008539.753141: Retrieving
host/idmsrvpru.idmpru.XXX.XXX.XX(a)IDMPRU.XXX.XXX.XX ->
krb5_ccache_conf_data/fast_avail/krbtgt\/ADTEST.XXX.XXX.XX\@ADTEST.XXX.XXX.XX(a)X-CACHECONF:
from KCM:0:84390 with result: -1765328243/Matching credential not found
> [47521] 1647008539.753143: Sending unauthenticated request
> [47521] 1647008539.753144: Sending request (179 bytes) to ADTEST.XXX.XXX.XX
> [47521] 1647008539.753145: Initiating TCP connection to stream [
http://10.2.100.4:88/ | 10.2.100.4:88 ]
> [47521] 1647008540.776855: Initiating TCP connection to stream [
http://10.2.100.3:88/ | 10.2.100.3:88 ]
> [47521] 1647008540.776856: Sending TCP request to stream [
http://10.2.100.3:88/ |
10.2.100.3:88 ]
> [47521] 1647008540.776857: Received answer (278 bytes) from stream [
http://10.2.100.3:88/ | 10.2.100.3:88 ]
> [47521] 1647008540.776858: Terminating TCP connection to stream [
http://10.2.100.4:88/ | 10.2.100.4:88 ]
> [47521] 1647008540.776859: Terminating TCP connection to stream [
http://10.2.100.3:88/ | 10.2.100.3:88 ]
> [47521] 1647008540.776860: Response was from master KDC
> [47521] 1647008540.776861: Received error from KDC: -1765328359/Additional
pre-authentication required
> [47521] 1647008540.776864: Preauthenticating using KDC method data
> [47521] 1647008540.776865: Processing preauth types: PA-PK-AS-REQ (16),
PA-PK-AS-REP_OLD (15), PA-ENC-TIMESTAMP (2), PA-ETYPE-INFO2 (19)
> [47521] 1647008540.776866: Selected etype info: etype aes256-cts, salt
"ADTEST.XXX.XXX.XXusu5", params "\x00\x00\x10\x00"
> [47521] 1647008540.776867: PKINIT client has no configured identity; giving up
> [47521] 1647008540.776868: PKINIT client has no configured identity; giving up
> [47521] 1647008540.776869: Preauth module pkinit (16) (real) returned: 22/Invalid
argument
> Password for usu5(a)ADTEST.XXX.XXX.XX:
> [47521] 1647008555.456745: AS key obtained for encrypted timestamp: aes256-cts/0DAE
> [47521] 1647008555.456747: Encrypted timestamp (for 1647008555.462202): plain
301AA011180F32303232303331313134323233355AA1050203070D7A, encrypted
588F164716268F95639456AEE7589886245643006D4F7B630289E1E745736D8B9037356B398C63F122292C02AAB12E25883A00C2E266E84C
> [47521] 1647008555.456748: Preauth module encrypted_timestamp (2) (real) returned:
0/Success
> [47521] 1647008555.456749: Produced preauth for next request: PA-ENC-TIMESTAMP (2)
> [47521] 1647008555.456750: Sending request (257 bytes) to ADTEST.XXX.XXX.XX
> [47521] 1647008555.456751: Initiating TCP connection to stream [
http://10.2.100.4:88/ | 10.2.100.4:88 ]
> [47521] 1647008556.458248: Initiating TCP connection to stream [
http://10.2.100.3:88/ | 10.2.100.3:88 ]
> [47521] 1647008556.458249: Sending TCP request to stream [
http://10.2.100.3:88/ |
10.2.100.3:88 ]
> [47521] 1647008556.458250: Received answer (1438 bytes) from stream [
http://10.2.100.3:88/ | 10.2.100.3:88 ]
> [47521] 1647008556.458251: Terminating TCP connection to stream [
http://10.2.100.4:88/ | 10.2.100.4:88 ]
> [47521] 1647008556.458252: Terminating TCP connection to stream [
http://10.2.100.3:88/ | 10.2.100.3:88 ]
> [47521] 1647008556.458253: Response was from master KDC
> [47521] 1647008556.458254: Processing preauth types: PA-PW-SALT (3)
> [47521] 1647008556.458255: Received salt "ADTEST.XXX.XXX.XXusu5" via
padata type PA-PW-SALT (3)
> [47521] 1647008556.458256: Produced preauth for next request: (empty)
> [47521] 1647008556.458257: AS key determined by preauth: aes256-cts/0DAE
> [47521] 1647008556.458258: Decrypted AS reply; session key is: aes256-cts/35D9
> [47521] 1647008556.458259: FAST negotiation: unavailable
> kpasswd: KDC reply did not match expectations getting initial ticket
>
> FYI, I have tried the same test with a user WITHOUT expired password, and it does
not work either, and the log is exactly the same. Indeed, when I log in with ssh with this
user, I cannot change the password too:
>
> $ passwd
> Changing password for user usu1(a)adtest.xxx.xx.xx.
> Current Password:
> Password change failed. Server message: Old password not accepted.
> passwd: Authentication token manipulation error
>
> Thanks very much.
>
>
>
>
>
> BQ_END
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland
>
>
>
>
> BQ_END
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland
>
(2022-04-11 10:13:19): [krb5_child[10339]] [main] (0x0400):
krb5_child started.
(2022-04-11 10:13:19): [krb5_child[10339]] [unpack_buffer] (0x1000): total buffer size:
[102]
(2022-04-11 10:13:19): [krb5_child[10339]] [unpack_buffer] (0x0100): cmd [249 (pre-auth)]
uid [10107] gid [10107] validate [true] enterprise principal [false] offline [false] UPN
[usu7(a)ADTEST.xxx.xxx.xx]
(2022-04-11 10:13:19): [krb5_child[10339]] [unpack_buffer] (0x0100): ccname: [KCM:]
old_ccname: [KCM:] keytab: [/etc/krb5.keytab]
(2022-04-11 10:13:19): [krb5_child[10339]] [k5c_setup_fast] (0x0100): Fast principal is
set to [host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx]
(2022-04-11 10:13:19): [krb5_child[10339]] [find_principal_in_keytab] (0x4000): Trying to
find principal host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx in keytab.
(2022-04-11 10:13:19): [krb5_child[10339]] [match_principal] (0x1000): Principal matched
to the sample (host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx).
(2022-04-11 10:13:19): [krb5_child[10340]] [become_user] (0x0200): Trying to become user
[0][0].
(2022-04-11 10:13:19): [krb5_child[10340]] [become_user] (0x0200): Already user [0].
(2022-04-11 10:13:19): [krb5_child[10340]] [check_fast_ccache] (0x2000): Running as
[0][0].
(2022-04-11 10:13:19): [krb5_child[10340]] [set_canonicalize_option] (0x0100):
Canonicalization is set to [true]
(2022-04-11 10:13:19): [krb5_child[10340]] [create_ccache] (0x4000): Initializing ccache
of type [FILE]
(2022-04-11 10:13:19): [krb5_child[10340]] [create_ccache] (0x4000): returning: 0
(2022-04-11 10:13:19): [krb5_child[10339]] [check_fast_ccache] (0x0200): FAST TGT was
successfully recreated!
(2022-04-11 10:13:19): [krb5_child[10339]] [become_user] (0x0200): Trying to become user
[10107][10107].
(2022-04-11 10:13:19): [krb5_child[10339]] [main] (0x2000): Running as [10107][10107].
(2022-04-11 10:13:19): [krb5_child[10339]] [set_lifetime_options] (0x0100): No specific
renewable lifetime requested.
(2022-04-11 10:13:19): [krb5_child[10339]] [set_lifetime_options] (0x0100): No specific
lifetime requested.
(2022-04-11 10:13:19): [krb5_child[10339]] [set_canonicalize_option] (0x0100):
Canonicalization is set to [true]
(2022-04-11 10:13:19): [krb5_child[10339]] [main] (0x0400): Will perform pre-auth
(2022-04-11 10:13:19): [krb5_child[10339]] [tgt_req_child] (0x1000): Attempting to get a
TGT
(2022-04-11 10:13:19): [krb5_child[10339]] [get_and_save_tgt] (0x0400): Attempting kinit
for realm [ADTEST.xxx.xxx.xx]
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417579: Getting initial credentials for usu7(a)ADTEST.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417580: FAST armor ccache:
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417581: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krb5_ccache_conf_data/fast_avail/krbtgt\/ADTEST.xxx.xxx.xx\@ADTEST.xxx.xxx.xx(a)X-CACHECONF:
from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result:
-1765328243/Matching credential not found
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417583: Sending unauthenticated request
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417584: Sending request (188 bytes) to ADTEST.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417585: Initiating TCP connection to stream 10.2.100.3:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417586: Sending TCP request to stream 10.2.100.3:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417587: Received answer (323 bytes) from stream 10.2.100.3:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417588: Terminating TCP connection to stream 10.2.100.3:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417589: Response was from master KDC
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417590: Received error from KDC: -1765328359/Additional pre-authentication
required
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417591: Upgrading to FAST due to presence of PA_FX_FAST in reply
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417592: FAST armor ccache:
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417593: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krb5_ccache_conf_data/fast_avail/krbtgt\/ADTEST.xxx.xxx.xx\@ADTEST.xxx.xxx.xx(a)X-CACHECONF:
from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result:
-1765328243/Matching credential not found
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417594: Getting credentials host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx
-> krbtgt/ADTEST.xxx.xxx.xx(a)ADTEST.xxx.xxx.xx using ccache
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417595: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krb5_ccache_conf_data/start_realm@X-CACHECONF: from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching
credential not found
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417596: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/ADTEST.xxx.xxx.xx(a)ADTEST.xxx.xxx.xx from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching
credential not found
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417597: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/ADTEST.xxx.xxx.xx(a)ADTEST.xxx.xxx.xx from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching
credential not found
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417598: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/IDMPRU.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: 0/Success
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417599: Starting with TGT for client realm:
host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/IDMPRU.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417600: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/ADTEST.xxx.xxx.xx(a)ADTEST.xxx.xxx.xx from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching
credential not found
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417601: Requesting TGT krbtgt/ADTEST.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx using TGT
krbtgt/IDMPRU.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417602: Generated subkey for TGS request: aes256-cts/8B9E
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417603: etypes requested in TGS request: aes256-cts, aes256-sha2,
camellia256-cts, aes128-cts, aes128-sha2, camellia128-cts
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417605: Encoding request body and padata into FAST request
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417606: Sending request (2074 bytes) to IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417607: Initiating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417608: Sending TCP request to stream 10.2.100.2:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417609: Received answer (510 bytes) from stream 10.2.100.2:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417610: Terminating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417611: Response was from master KDC
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417612: Decoding FAST response
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417613: TGS request result: -1765328377/Server
krbtgt/ADTEST.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx not found in Kerberos database
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417614: Trying next closer realm in path: ADTEST.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417615: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/ADTEST.xxx.xxx.xx(a)ADTEST.xxx.xxx.xx from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching
credential not found
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417616: Requesting TGT krbtgt/ADTEST.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx using TGT
krbtgt/IDMPRU.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417617: Generated subkey for TGS request: aes256-cts/F32C
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417618: etypes requested in TGS request: aes256-cts, aes256-sha2,
camellia256-cts, aes128-cts, aes128-sha2, camellia128-cts
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417620: Encoding request body and padata into FAST request
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417621: Sending request (2074 bytes) to IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417622: Initiating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417623: Sending TCP request to stream 10.2.100.2:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417624: Received answer (510 bytes) from stream 10.2.100.2:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417625: Terminating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417626: Response was from master KDC
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417627: Decoding FAST response
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339]
1649682799.417628: TGS request result: -1765328377/Server
krbtgt/ADTEST.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx not found in Kerberos database
(2022-04-11 10:13:19): [krb5_child[10339]] [get_and_save_tgt] (0x0400):
krb5_get_init_creds_password returned [-1765328377] during pre-auth.
(2022-04-11 10:13:19): [krb5_child[10339]] [k5c_send_data] (0x0200): Received error code
0
(2022-04-11 10:13:19): [krb5_child[10339]] [pack_response_packet] (0x2000): response
packet size: [4]
(2022-04-11 10:13:19): [krb5_child[10339]] [k5c_send_data] (0x4000): Response sent.
(2022-04-11 10:13:19): [krb5_child[10339]] [main] (0x0400): krb5_child completed
successfully
(2022-04-11 10:13:32): [krb5_child[10343]] [main] (0x0400): krb5_child started.
(2022-04-11 10:13:32): [krb5_child[10343]] [unpack_buffer] (0x1000): total buffer size:
[119]
(2022-04-11 10:13:32): [krb5_child[10343]] [unpack_buffer] (0x0100): cmd [241 (auth)] uid
[10107] gid [10107] validate [true] enterprise principal [false] offline [false] UPN
[usu7(a)ADTEST.xxx.xxx.xx]
(2022-04-11 10:13:32): [krb5_child[10343]] [unpack_buffer] (0x0100): ccname: [KCM:]
old_ccname: [KCM:] keytab: [/etc/krb5.keytab]
(2022-04-11 10:13:32): [krb5_child[10343]] [switch_creds] (0x0200): Switch user to
[10107][10107].
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_krb5_cc_verify_ccache] (0x2000): TGT not
found or expired.
(2022-04-11 10:13:32): [krb5_child[10343]] [switch_creds] (0x0200): Switch user to
[0][0].
(2022-04-11 10:13:32): [krb5_child[10343]] [k5c_check_old_ccache] (0x4000): Ccache_file
is [KCM:] and is not active and TGT is valid.
(2022-04-11 10:13:32): [krb5_child[10343]] [k5c_precreate_ccache] (0x4000): Recreating
ccache
(2022-04-11 10:13:32): [krb5_child[10343]] [k5c_setup_fast] (0x0100): Fast principal is
set to [host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx]
(2022-04-11 10:13:32): [krb5_child[10343]] [find_principal_in_keytab] (0x4000): Trying to
find principal host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx in keytab.
(2022-04-11 10:13:32): [krb5_child[10343]] [match_principal] (0x1000): Principal matched
to the sample (host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx).
(2022-04-11 10:13:32): [krb5_child[10343]] [check_fast_ccache] (0x0200): FAST TGT is
still valid.
(2022-04-11 10:13:32): [krb5_child[10343]] [become_user] (0x0200): Trying to become user
[10107][10107].
(2022-04-11 10:13:32): [krb5_child[10343]] [main] (0x2000): Running as [10107][10107].
(2022-04-11 10:13:32): [krb5_child[10343]] [set_lifetime_options] (0x0100): No specific
renewable lifetime requested.
(2022-04-11 10:13:32): [krb5_child[10343]] [set_lifetime_options] (0x0100): No specific
lifetime requested.
(2022-04-11 10:13:32): [krb5_child[10343]] [set_canonicalize_option] (0x0100):
Canonicalization is set to [true]
(2022-04-11 10:13:32): [krb5_child[10343]] [main] (0x0400): Will perform auth
(2022-04-11 10:13:32): [krb5_child[10343]] [main] (0x0400): Will perform online auth
(2022-04-11 10:13:32): [krb5_child[10343]] [tgt_req_child] (0x1000): Attempting to get a
TGT
(2022-04-11 10:13:32): [krb5_child[10343]] [get_and_save_tgt] (0x0400): Attempting kinit
for realm [ADTEST.xxx.xxx.xx]
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847088: Getting initial credentials for usu7(a)ADTEST.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847089: FAST armor ccache:
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847090: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krb5_ccache_conf_data/fast_avail/krbtgt\/ADTEST.xxx.xxx.xx\@ADTEST.xxx.xxx.xx(a)X-CACHECONF:
from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result:
-1765328243/Matching credential not found
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847092: Sending unauthenticated request
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847093: Sending request (188 bytes) to ADTEST.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847094: Initiating TCP connection to stream 10.2.100.3:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847095: Sending TCP request to stream 10.2.100.3:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847096: Received answer (323 bytes) from stream 10.2.100.3:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847097: Terminating TCP connection to stream 10.2.100.3:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847098: Response was from master KDC
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847099: Received error from KDC: -1765328359/Additional pre-authentication
required
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847100: Upgrading to FAST due to presence of PA_FX_FAST in reply
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847101: FAST armor ccache:
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847102: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krb5_ccache_conf_data/fast_avail/krbtgt\/ADTEST.xxx.xxx.xx\@ADTEST.xxx.xxx.xx(a)X-CACHECONF:
from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result:
-1765328243/Matching credential not found
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847103: Getting credentials host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx
-> krbtgt/ADTEST.xxx.xxx.xx(a)ADTEST.xxx.xxx.xx using ccache
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847104: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krb5_ccache_conf_data/start_realm@X-CACHECONF: from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching
credential not found
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847105: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/ADTEST.xxx.xxx.xx(a)ADTEST.xxx.xxx.xx from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching
credential not found
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847106: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/ADTEST.xxx.xxx.xx(a)ADTEST.xxx.xxx.xx from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching
credential not found
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847107: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/IDMPRU.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: 0/Success
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847108: Starting with TGT for client realm:
host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/IDMPRU.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847109: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/ADTEST.xxx.xxx.xx(a)ADTEST.xxx.xxx.xx from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching
credential not found
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847110: Requesting TGT krbtgt/ADTEST.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx using TGT
krbtgt/IDMPRU.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847111: Generated subkey for TGS request: aes256-cts/6875
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847112: etypes requested in TGS request: aes256-cts, aes256-sha2,
camellia256-cts, aes128-cts, aes128-sha2, camellia128-cts
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847114: Encoding request body and padata into FAST request
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847115: Sending request (2074 bytes) to IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847116: Initiating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847117: Sending TCP request to stream 10.2.100.2:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847118: Received answer (510 bytes) from stream 10.2.100.2:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847119: Terminating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847120: Response was from master KDC
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847121: Decoding FAST response
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847122: TGS request result: -1765328377/Server
krbtgt/ADTEST.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx not found in Kerberos database
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847123: Trying next closer realm in path: ADTEST.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847124: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/ADTEST.xxx.xxx.xx(a)ADTEST.xxx.xxx.xx from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching
credential not found
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847125: Requesting TGT krbtgt/ADTEST.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx using TGT
krbtgt/IDMPRU.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847126: Generated subkey for TGS request: aes256-cts/9132
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847127: etypes requested in TGS request: aes256-cts, aes256-sha2,
camellia256-cts, aes128-cts, aes128-sha2, camellia128-cts
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847129: Encoding request body and padata into FAST request
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847130: Sending request (2074 bytes) to IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847131: Initiating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847132: Sending TCP request to stream 10.2.100.2:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847133: Received answer (510 bytes) from stream 10.2.100.2:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847134: Terminating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847135: Response was from master KDC
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847136: Decoding FAST response
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343]
1649682812.847137: TGS request result: -1765328377/Server
krbtgt/ADTEST.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx not found in Kerberos database
(2022-04-11 10:13:32): [krb5_child[10343]] [get_and_save_tgt] (0x0020): 1724:
[-1765328377][Error constructing AP-REQ armor: Server
krbtgt/ADTEST.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx not found in Kerberos database]
(2022-04-11 10:13:32): [krb5_child[10343]] [map_krb5_error] (0x0020): 1853:
[-1765328377][Error constructing AP-REQ armor: Server
krbtgt/ADTEST.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx not found in Kerberos database]
(2022-04-11 10:13:32): [krb5_child[10343]] [k5c_send_data] (0x0200): Received error code
1432158209
(2022-04-11 10:13:32): [krb5_child[10343]] [pack_response_packet] (0x2000): response
packet size: [4]
(2022-04-11 10:13:32): [krb5_child[10343]] [k5c_send_data] (0x4000): Response sent.
(2022-04-11 10:13:32): [krb5_child[10343]] [main] (0x0400): krb5_child completed
successfully
(2022-04-11 10:13:34): [krb5_child[10348]] [main] (0x0400): krb5_child started.
(2022-04-11 10:13:34): [krb5_child[10348]] [unpack_buffer] (0x1000): total buffer size:
[102]
(2022-04-11 10:13:34): [krb5_child[10348]] [unpack_buffer] (0x0100): cmd [249 (pre-auth)]
uid [10107] gid [10107] validate [true] enterprise principal [false] offline [false] UPN
[usu7(a)ADTEST.xxx.xxx.xx]
(2022-04-11 10:13:34): [krb5_child[10348]] [unpack_buffer] (0x0100): ccname: [KCM:]
old_ccname: [KCM:] keytab: [/etc/krb5.keytab]
(2022-04-11 10:13:34): [krb5_child[10348]] [k5c_setup_fast] (0x0100): Fast principal is
set to [host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx]
(2022-04-11 10:13:34): [krb5_child[10348]] [find_principal_in_keytab] (0x4000): Trying to
find principal host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx in keytab.
(2022-04-11 10:13:34): [krb5_child[10348]] [match_principal] (0x1000): Principal matched
to the sample (host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx).
(2022-04-11 10:13:34): [krb5_child[10348]] [check_fast_ccache] (0x0200): FAST TGT is
still valid.
(2022-04-11 10:13:34): [krb5_child[10348]] [become_user] (0x0200): Trying to become user
[10107][10107].
(2022-04-11 10:13:34): [krb5_child[10348]] [main] (0x2000): Running as [10107][10107].
(2022-04-11 10:13:34): [krb5_child[10348]] [set_lifetime_options] (0x0100): No specific
renewable lifetime requested.
(2022-04-11 10:13:34): [krb5_child[10348]] [set_lifetime_options] (0x0100): No specific
lifetime requested.
(2022-04-11 10:13:34): [krb5_child[10348]] [set_canonicalize_option] (0x0100):
Canonicalization is set to [true]
(2022-04-11 10:13:34): [krb5_child[10348]] [main] (0x0400): Will perform pre-auth
(2022-04-11 10:13:34): [krb5_child[10348]] [tgt_req_child] (0x1000): Attempting to get a
TGT
(2022-04-11 10:13:34): [krb5_child[10348]] [get_and_save_tgt] (0x0400): Attempting kinit
for realm [ADTEST.xxx.xxx.xx]
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673946: Getting initial credentials for usu7(a)ADTEST.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673947: FAST armor ccache:
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673948: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krb5_ccache_conf_data/fast_avail/krbtgt\/ADTEST.xxx.xxx.xx\@ADTEST.xxx.xxx.xx(a)X-CACHECONF:
from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result:
-1765328243/Matching credential not found
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673950: Sending unauthenticated request
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673951: Sending request (188 bytes) to ADTEST.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673952: Initiating TCP connection to stream 10.2.100.3:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673953: Sending TCP request to stream 10.2.100.3:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673954: Received answer (323 bytes) from stream 10.2.100.3:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673955: Terminating TCP connection to stream 10.2.100.3:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673956: Response was from master KDC
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673957: Received error from KDC: -1765328359/Additional pre-authentication
required
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673958: Upgrading to FAST due to presence of PA_FX_FAST in reply
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673959: FAST armor ccache:
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673960: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krb5_ccache_conf_data/fast_avail/krbtgt\/ADTEST.xxx.xxx.xx\@ADTEST.xxx.xxx.xx(a)X-CACHECONF:
from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result:
-1765328243/Matching credential not found
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673961: Getting credentials host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx
-> krbtgt/ADTEST.xxx.xxx.xx(a)ADTEST.xxx.xxx.xx using ccache
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673962: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krb5_ccache_conf_data/start_realm@X-CACHECONF: from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching
credential not found
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673963: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/ADTEST.xxx.xxx.xx(a)ADTEST.xxx.xxx.xx from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching
credential not found
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673964: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/ADTEST.xxx.xxx.xx(a)ADTEST.xxx.xxx.xx from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching
credential not found
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673965: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/IDMPRU.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: 0/Success
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673966: Starting with TGT for client realm:
host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/IDMPRU.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673967: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/ADTEST.xxx.xxx.xx(a)ADTEST.xxx.xxx.xx from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching
credential not found
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673968: Requesting TGT krbtgt/ADTEST.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx using TGT
krbtgt/IDMPRU.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673969: Generated subkey for TGS request: aes256-cts/3A50
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673970: etypes requested in TGS request: aes256-cts, aes256-sha2,
camellia256-cts, aes128-cts, aes128-sha2, camellia128-cts
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673972: Encoding request body and padata into FAST request
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673973: Sending request (2074 bytes) to IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673974: Initiating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673975: Sending TCP request to stream 10.2.100.2:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673976: Received answer (510 bytes) from stream 10.2.100.2:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673977: Terminating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673978: Response was from master KDC
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673979: Decoding FAST response
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673980: TGS request result: -1765328377/Server
krbtgt/ADTEST.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx not found in Kerberos database
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673981: Trying next closer realm in path: ADTEST.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673982: Retrieving host/idmsrvpru.idmpru.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx ->
krbtgt/ADTEST.xxx.xxx.xx(a)ADTEST.xxx.xxx.xx from
MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching
credential not found
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673983: Requesting TGT krbtgt/ADTEST.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx using TGT
krbtgt/IDMPRU.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673984: Generated subkey for TGS request: aes256-cts/625C
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673985: etypes requested in TGS request: aes256-cts, aes256-sha2,
camellia256-cts, aes128-cts, aes128-sha2, camellia128-cts
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673987: Encoding request body and padata into FAST request
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673988: Sending request (2074 bytes) to IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673989: Initiating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673990: Sending TCP request to stream 10.2.100.2:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673991: Received answer (510 bytes) from stream 10.2.100.2:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673992: Terminating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673993: Response was from master KDC
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673994: Decoding FAST response
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348]
1649682814.673995: TGS request result: -1765328377/Server
krbtgt/ADTEST.xxx.xxx.xx(a)IDMPRU.xxx.xxx.xx not found in Kerberos database
(2022-04-11 10:13:34): [krb5_child[10348]] [get_and_save_tgt] (0x0400):
krb5_get_init_creds_password returned [-1765328377] during pre-auth.
(2022-04-11 10:13:34): [krb5_child[10348]] [k5c_send_data] (0x0200): Received error code
0
(2022-04-11 10:13:34): [krb5_child[10348]] [pack_response_packet] (0x2000): response
packet size: [4]
(2022-04-11 10:13:34): [krb5_child[10348]] [k5c_send_data] (0x4000): Response sent.
(2022-04-11 10:13:34): [krb5_child[10348]] [main] (0x0400): krb5_child completed
successfully