I don't control the AD, but I looked and couldn't find a policy mandating machine
password changes outside of the standard time. I am not running msktutil, but I don't
really see why I should have to. This is what sssd is supposed to be doing for me, and
it's working just fine in CentOS and RedHat out of the box.
Neil
-----Original Message-----
From: John Hodrien [mailto:J.H.Hodrien@leeds.ac.uk]
Sent: Tuesday, December 01, 2015 10:13 AM
To: End-user discussions about the System Security Services Daemon
<sssd-users(a)lists.fedorahosted.org>
Subject: [SSSD-users]Re: Kerberos ticket renewal with AD
On Tue, 1 Dec 2015, Thackeray, Neil L wrote:
I’m having this problem as well. This is only happening on Ubuntu
machines for me, the RedHat and CentOS machines don’t seem to have this issue. I was
starting to think this might be a problem with Kerberos libraries or something, otherwise
I can’t understand why it wouldn’t work only on Ubuntu.
I monitor when one of my servers loses contact with the AD by running a cron script every
10 minutes:
#!/bin/bash
HOST=`hostname`
TST=`kinit -k 'SERVERNAME $(a)AD.MYDOMAIN.COM' 2>&1` if [ "$TST"
!= ""
]; then
logger -p user.crit "SSSD AUTH ERROR: [$DATE] $TST on $HOST"
DATE=`date`
echo "[$DATE]" $TST>>/root/sssd-weirdness.txt fi
Have you got something in AD mandating machine password changes, or do you have something
like msktutil running doing it for you?
jh