Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an issue with Linux clients trying to AD authentication by targeting a DNS name (corp.example.com). I have 2 Domain Controller servers DC1(10.0.0.3/24), DC2(10.1.0.3/24) both domain controllers for corp.example.com. Before starting this each Linux client had 1 of the 2 AD servers IP addresses explicitly defined on it. I went through and replaced the IP address with the Domain name (corp.example.com) as shown below in the configs. Tested it and it works great. However, testing failover by turning off one of the Dome Controller servers renders some Linux clients unable to authenticate and times out. See DC/DNS failover with global/common DNS roundrobin for my originally post when I thought it was an network issue. On the Linux clients:

/etc/openldap/ldap.conf

  uri     ldap://DC1 ldap://DC2
    base    dc=corp,dc=example,dc=com

/etc/krb5.conf

[libdefaults]
        default_realm = corp.example.com
        clockskew = 300
        dns_lookup_kdc
#       default_realm = EXAMPLE.COM

[realms]
corp.example.com= {
        kdc = corp.example.com
        default_domain = corp.example.com
        kpasswd_server = corp.example.com
        admin_server = corp.example.com
}
#       EXAMPLE.COM = {
#                kdc = kerberos.example.com
#               admin_server = kerberos.example.com
#       }

[logging]
        kdc = FILE:/var/log/krb5/krb5kdc.log
        admin_server = FILE:/var/log/krb5/kadmind.log
        default = SYSLOG:NOTICE:DAEMON
[domain_realm]
        .corp.example.com = corp.example.com
        .corp = corp.example.com
[appdefaults]
pam = {
        ticket_lifetime = 1d
        renew_lifetime = 1d
        forwardable = true
        proxiable = false
        minimum_uid = 1
        external = sshd
        use_shmem = sshd
        clockskew = 300
        retain_after_close = false
}

/etc/resolve.conf

search corp.example.com
nameserver 10.0.0.3
nameserver 10.1.0.3

This is what I see in the syslog-ng

Nov 30 09:04:56 linux_client nscd: nss_ldap: failed to bind to LDAP server ldap://ad3: Can't contact LDAP server
Nov 30 09:04:59 linux_client sshd[15585]: nss_ldap: failed to bind to LDAP server ldap://ad3: Can't contact LDAP server
Nov 30 08:50:19 linux_client sshd[15242]: Accepted keyboard-interactive/pam for jim from 10.0.0.231 port 61288 ssh2
Nov 30 08:52:02 linux_client sshd[15284]: nss_ldap: could not search LDAP server - Server is unavailable
Nov 30 08:53:09 linux_client sshd[15284]: pam_unix2(sshd:auth): conversation failed
Nov 30 08:53:16 linux_client sshd[15284]: error: ssh_msg_send: write
Nov 30 08:53:26 linux_client sshd[15284]: pam_krb5[15284]: authentication fails for 'jim' (jim@corp.example.com): Authentication failure (Cannot read password)
Nov 30 08:53:26 linux_client sshd[15284]: error: ssh_msg_send: write
Nov 30 08:56:02 linux_client sshd[15289]: nss_ldap: could not search LDAP server - Server is unavailable
Nov 30 08:56:27 linux_client sshd[15289]: pam_krb5[15289]: authentication succeeds for 'jim' (jim@corp.example.com)
Nov 30 08:57:12 linux_client sshd[15289]: nss_ldap: could not search LDAP server - Server is unavailable
Nov 30 08:57:18 linux_client sshd[15289]: _rebind_proc
Nov 30 08:57:31 linux_client sshd[15289]: _rebind_proc
Nov 30 08:57:34 linux_client sshd[15289]: _rebind_proc
Nov 30 08:57:34 linux_client sshd[15289]: pam_ldap: ldap_result Timed out
Nov 30 08:57:34 linux_client sshd[15289]: error: ssh_msg_send: write

I looks like it is not trying the other DCs?

share|improve this question
    
The DC's are in different subnets. Can the Linux clients reach and communicate with both subnets? –  joeqwerty Nov 29 '12 at 21:27
    
Yes,there is a router between. –  Jim Nov 30 '12 at 13:51

1 Answer 1

Instead of using DNS to fail-over your domain controllers, /etc/openldap/ldap.conf allows you to use a space separated list of ldap servers. You can still use host names instead of actual IP addresses as well.

For example: URI ldap://dc01.corp.example.com ldap://dc02.corp.example.com

For more information see: http://linux.die.net/man/5/ldap.conf

I also noticed your 2 IP addresses from above are in separate subnets. Make sure your clients have comms to both. You have already looked into network issues so you are probably fine but I wanted to mention it just in case.

share|improve this answer
    
Tried URI ldap://DC1 ldap://DC2, which works when DC1 is accessible, but not when I turn off DC1 to test failover it times out when authenticating. –  Jim Nov 30 '12 at 13:53
    
Now tried URI ldap://10.0.0.3 ldap://10.1.0.3, but still doesn't work when 10.0.0.3 is unavailable. Logs show it keeps trying to contact ldap://10.0.0.3?? Is there a parameter I have to set in ldap.conf to have it try other ldap servers? –  Jim Nov 30 '12 at 14:21
    
try setting the bind_timelimit <timelimit> I have not had to do that before but it is worth testing/researching. –  Brian W Nov 30 '12 at 19:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.