Hi Jakub,
On Dec 18, 2013, at 03:35 AM, Jakub Hrozek <jhrozek(a)redhat.com> wrote:
On Wed, Dec 18, 2013 at 09:42:48AM +0100, Sumit Bose wrote:
On Wed, Dec 18, 2013 at 12:54:37AM +0000, Bryan Harris wrote:
Here is my output from klist -ke :
root@client:~# klist -ke
Keytab name: WRFILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
5 host/server.domain.local(a)DOMAIN.LOCAL (DES cbc mode with CRC-32)
5 host/server.domain.local(a)DOMAIN.LOCAL (DES cbc mode with RSA-MD5)
5 host/server.domain.local(a)DOMAIN.LOCAL (ArcFour with HMAC/md5)
5 host/server.domain.local(a)DOMAIN.LOCAL (AES-256 CTS mode with 96-bit SHA-1 HMAC)
5 host/server.domain.local(a)DOMAIN.LOCAL (AES-128 CTS mode with 96-bit SHA-1 HMAC)
You need CLIENT$(a)AD.EXAMPLE.COM in the keytab as well. Any chance you
used -setupn with the ktpass command? If yes, please try without.
btw keytabs that are generated with Samba or realmd should already
contain this principal. In general, I think using Samba or realmd is
even easier and should be recommended.
When I try using the commands from the guide for using Samba, this is the output I receive
for doing with -U Administrator (see below for -k method).
net ads join -U Administrator
Enter Administrator's password:
[2013/12/18 16:35:48.221674, 0] libads/sasl.c:821(ads_sasl_spnego_bind)
kinit succeeded but ads_sasl_spnego_krb5_bind failed: Invalid credentials
Failed to join domain: failed to connect to AD: Invalid credentials
When I try using the -k method, this is the output.
kinit administrator
Password for administrator(a)DOMAIN.LOCAL:
root@client:/var/log/sssd# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator(a)DOMAIN.LOCAL
Valid starting Expires Service principal
12/18/13 16:34:33 12/19/13 02:34:34 krbtgt/DOMAIN.LOCAL(a)DOMAIN.LOCAL
renew until 12/25/13 16:34:33
root@client:/var/log/sssd# net ads join -k
Failed to join domain: failed to lookup DC info for domain 'DOMAIN.LOCAL' over
rpc: Logon failure
Any ideas? Do you think it means I have a firewall problem? It lets me have a kerberos
ticket at least, I guess that's good?
Bryan