[SSSD-users] startup problem/port status 0

Longina Przybyszewska longina at sdu.dk
Thu Nov 8 11:22:04 UTC 2012


Hi,
My machine joined AD - I can get attributes with ldapsearch as aduser (and as local root):

alongina at victoria:~$ ldapsearch  -E pr=1000/noprompt -H ldap://nat.c.sdu.dk -Y GSSAPI  -b 'ou=Linux computers,ou=ADResources,dc=nat,dc=c,dc=sdu,dc=dk' '(&(objectClass=computer)(name=victoria))'
SASL/GSSAPI authentication started
SASL username: alongina at NAT.C.SDU.DK
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <ou=Linux computers,ou=ADResources,dc=nat,dc=c,dc=sdu,dc=dk> with scope subtree
# filter: (&(objectClass=computer)(name=victoria))
# requesting: ALL
# with pagedResults control: size=1000
#

# VICTORIA, Linux computers, ADResources, nat.c.sdu.dk
dn: CN=VICTORIA,OU=Linux computers,OU=ADResources,DC=nat,DC=c,DC=sdu,DC=dk
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
cn: VICTORIA
distinguishedName: CN=VICTORIA,OU=Linux computers,OU=ADResources,DC=nat,DC=c,D
 C=sdu,DC=dk
instanceType: 4
whenCreated: 20121107151527.0Z
whenChanged: 20121108100744.0Z
uSNCreated: 22665166
uSNChanged: 22700883
name: VICTORIA
objectGUID:: Np8rYg/Jxka041fkPw1blA==
userAccountControl: 4096
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 129967763011945002
lastLogoff: 0
lastLogon: 129968428368941751
localPolicyFlags: 0
pwdLastSet: 129968428370191767
primaryGroupID: 515
objectSid:: AQUAAAAAAAUVAAAANYoCGg16WjOCi6YoUC4AAA==
accountExpires: 9223372036854775807
logonCount: 1
sAMAccountName: VICTORIA$
sAMAccountType: 805306369
dNSHostName: victoria.nat.c.sdu.dk
servicePrincipalName: host/victoria.nat.c.sdu.dk
servicePrincipalName: host/victoria
objectCategory: CN=Computer,CN=Schema,CN=Configuration,DC=c,DC=sdu,DC=dk
isCriticalSystemObject: FALSE
dSCorePropagationData: 16010101000000.0Z
lastLogonTimestamp: 129968428370187304
msDS-SupportedEncryptionTypes: 28

# search result
search: 4
result: 0 Success
control: 1.2.840.113556.1.4.319 false MIQAAAAFAgEABAA=
pagedresults: cookie=

# numResponses: 2
# numEntries: 1


The /etc/krb5.keytab :
alongina at victoria:~$ sudo klist -e -k
[sudo] password for alongina: 
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   7 victoria$@NAT.C.SDU.DK (arcfour-hmac) 
   7 victoria$@NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 
   7 victoria$@NAT.C.SDU.DK (aes256-cts-hmac-sha1-96) 
   7 host/victoria at NAT.C.SDU.DK (arcfour-hmac) 
   7 host/victoria at NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 
   7 host/victoria at NAT.C.SDU.DK (aes256-cts-hmac-sha1-96) 
   7 host/victoria.nat.c.sdu.dk at NAT.C.SDU.DK (arcfour-hmac) 
   7 host/victoria.nat.c.sdu.dk at NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 
   7 host/victoria.nat.c.sdu.dk at NAT.C.SDU.DK (aes256-cts-hmac-sha1-96)  

Does it make difference victoria$<-->VICTORIA$ ???
Because in AD :
sSAMAccountName VICTORIA$

I can't make kinit using keytab:

alongina at victoria:~$ kinit -k -t /etc/krb5.keytab victoria$@NAT.C.SDU.DK
kinit: Client not found in Kerberos database while getting initial credentials
alongina at victoria:~$ kinit -k -t /etc/krb5.keytab host/victoria at NAT.C.SDU.DK
kinit: Client not found in Kerberos database while getting initial credentials
alongina at victoria:~$ kinit -k -t /etc/krb5.keytab victoria$
kinit: Generic preauthentication failure while getting initial credentials
alongina at victoria:~$ kinit -k -t /etc/krb5.keytab 'victoria$'
kinit: Generic preauthentication failure while getting initial credentials

I use msktutils for joining AD
Longina 

-----Original Message-----
From: sssd-users-bounces at lists.fedorahosted.org [mailto:sssd-users-bounces at lists.fedorahosted.org] On Behalf Of Jakub Hrozek
Sent: 8. november 2012 10:54
To: sssd-users at lists.fedorahosted.org
Subject: Re: [SSSD-users] startup problem/port status 0

On Tue, Nov 06, 2012 at 02:16:26PM +0000, Longina Przybyszewska wrote:
> Hi again,
> Thanks a lot for guiding me so far :)
> 
> I have got sssd-1.9.2 package from Timo, Ubuntu sssd package maintainer for  Ubuntu Quantal.
> 
> SSSD is configured against  AD as auth/id - provider
> 
> sssd.conf
> 
> [sssd]
> debug_level = 0x1310
> config_file_version = 2
> services = nss, pam
> domains = nat.c.sdu.dk
> 
> [nss]
> filter_groups = root
> filter_users = root
> 
> [pam]
> 
> [domain/nat.c.sdu.dk]
> 
> debug_level = 0x1310
> 
> enumerate = False
> min_id = 1000
> max_id = 20000
> 
> auth_provider = ad
> id_provider = ad
> access_provider = ad
> chpass_provider = ad
> 
> ad_server = nat.c.sdu.dk
> ad_hostname = testina4$.nat.c.sdu.dk
> ad_domain = nat.c.sdu.dk
> 
> 
> From  log:
> (Tue Nov  6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] 
> [be_resolve_server_process] (0x1000): Saving the first resolved server 
> (Tue Nov  6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] 
> [be_resolve_server_process] (0x0200): Found address for server 
> nat.c.sdu.dk: [10.144.5.18] TTL 455  (Tue Nov  6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: testina4$ (Tue Nov  6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [fo_set_port_status] (0x0100): Marking port 0 of server 'nat.c.sdu.dk' as 'not working (Tue Nov  6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'
> (Tue Nov  6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [get_server_status] (0x1000): Status of server 'nat.c.sdu.dk' is 'name resolved'
> (Tue Nov  6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [get_port_status] (0x1000): Port status of port 0 for server 'nat.c.sdu.dk' is 'not working'
> (Tue Nov  6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] 
> [be_resolve_server_done] (0x1000): Server resolution failed: 5 (Tue 
> Nov  6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [acctinfo_callback] 
> (0x0100): Request processed. Returned 1,11,Offline (Tue Nov  6 
> 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [remove_krb5_info_files] 
> (0x0200): Could not remove 
> [/var/lib/sss/pubconf/kpasswdinfo.NAT.C.SDU.DK], [2][No such file or 
> directory
> 

There is not all the information in the log, raising the debug_level might provide more info, but I think the problem is in the kinit.

Can you kinit as the principal specified in the ad_hostname and then ldapsearch the directory?

Are you sure about the principal in ad_hostname? I think it is typically HOST$@DOMAIN, your principal doesn't contain the at-sign.
_______________________________________________
sssd-users mailing list
sssd-users at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


More information about the sssd-users mailing list