Hi,
I have my Fedora 36 laptop joined to an AD with sssd-2.7.4.
AD DCs are Fedora 37 servers with Samba 4.17.8.
Everything seems to be working fine, though i see this cldap error messages on my sssd_test.com.log:
* ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc1.test.com:3268: unable to get netlogon information * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc1.test.com:3268: unable to get netlogon information * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_done] (0x0040): Unable to get site and forest information [2]: No such file or directory * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc1.test.com:3268: unable to get netlogon information * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc1.test.com:3268: unable to get netlogon information * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_done] (0x0040): Unable to get site and forest information [2]: No such file or directory
Anyone knows what this might be?
Hello,
-------- (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error <-- * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information <--- * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_done] (0x0040): Unable to get site and forest information [2]: No such file or directory <--- ---------
- Looks like an issue with DNS/network. sssd is not able to list the AD site or server details. Please enable sssd debugging to get the details. Moreover, you could check if SRV records are working fine.
- To verify the DNS SRV LDAP records: # dig -t SRV _ldap._tcp.ad.example.com
- Alternatively, you can try hardcoding `ad_server` under the [$domain] section of the /etc/sssd/sssd.conf
Thank you,
Roy
On Thu, May 18, 2023 at 4:41 PM Maverick . mvrk@sapo.pt wrote:
Hi,
I have my Fedora 36 laptop joined to an AD with sssd-2.7.4.
AD DCs are Fedora 37 servers with Samba 4.17.8.
Everything seems to be working fine, though i see this cldap error messages on my sssd_test.com.log:
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server]
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc1.test.com:3268: unable to get netlogon information
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server]
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server]
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc1.test.com:3268: unable to get netlogon information
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server]
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_done] (0x0040): Unable to get site and forest information [2]: No such file or directory
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server]
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc1.test.com:3268: unable to get netlogon information
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server]
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server]
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc1.test.com:3268: unable to get netlogon information
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server]
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information
- ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_done] (0x0040): Unable to get site and forest information [2]: No such file or directory
Anyone knows what this might be? _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi,
Everything looks good with DNS:
dig -t SRV _ldap._tcp.test.com
; <<>> DiG 9.16.40-RH <<>> -t SRV _ldap._tcp.test.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13682 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 3
;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 65494 ;; QUESTION SECTION: ;_ldap._tcp.test.com. IN SRV
;; ANSWER SECTION: _ldap._tcp.test.com. 7129 IN SRV 0 100 389 dc1.test.com. _ldap._tcp.test.com. 7129 IN SRV 1 101 389 dc2.test.com.
;; ADDITIONAL SECTION: dc2.test.com. 7129 IN A 192.168.10.12 dc1.test.com. 7129 IN A 192.168.10.11
;; Query time: 0 msec ;; SERVER: 127.0.0.53#53(127.0.0.53) ;; WHEN: Thu May 18 15:50:48 CEST 2023 ;; MSG SIZE rcvd: 157
CLDAP is Connection-less LDAP, over UDP. Check that firewalls are allowing the traffic and listeners up and responding
On Thu, May 18, 2023, 9:53 AM Maverick . mvrk@sapo.pt wrote:
Hi,
Everything looks good with DNS:
dig -t SRV _ldap._tcp.test.com
; <<>> DiG 9.16.40-RH <<>> -t SRV _ldap._tcp.test.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13682 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 3
;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 65494 ;; QUESTION SECTION: ;_ldap._tcp.test.com. IN SRV
;; ANSWER SECTION: _ldap._tcp.test.com. 7129 IN SRV 0 100 389 dc1.test.com. _ldap._tcp.test.com. 7129 IN SRV 1 101 389 dc2.test.com.
;; ADDITIONAL SECTION: dc2.test.com. 7129 IN A 192.168.10.12 dc1.test.com. 7129 IN A 192.168.10.11
;; Query time: 0 msec ;; SERVER: 127.0.0.53#53(127.0.0.53) ;; WHEN: Thu May 18 15:50:48 CEST 2023 ;; MSG SIZE rcvd: 157 _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Very strange thing, now i don't see the errors anymore, i changed debug level to 9, restarted, and errors are not showing anymore
I have the firewall ports open.
The errors are back again.
From sssd debug logs i think i see here 2 problems, one with openldap and the other with sssd:
1 - sssd is trying to make a cldap call to port 3268 (cldap://dc1.test.com:3268) which is wrong, SAMBA4 AD is listening for cldap on port 389 UDP.
2 - I had tcpdump running on my laptop and on AD DC server for udp port 389, and no packets left my laptop or arrived at the AD DC server when run: ldapsearch -LL -H cldap://192.168.10.11:389 -b "" -s base '(&(DnsDomain=azar.pt)(NtVer=\14\00\00\00))' ldap_bind: Can't contact LDAP server (-1)
Ok, found the real problem, on the laptop i'm using my dd-wrt router as dns, and the AD records on dd-wrt dnsmasq were wrong.
After fixing the DNS records, now it returns the correct port (389) for _ldap._tcp.Default-First-Site-Name._sites and sssd now works fine with cldap.
sssd-users@lists.fedorahosted.org
-
Abhijit Roy -
brendan kearney -
Maverick .