4

Has anyone here seen their Linux servers removed from AD domain due to expired machine credentials? We are using AD authentication with sssd-1.13.3-56.el6 (Centos 6)

Per "https://bugzilla.redhat.com/show_bug.cgi?id=1290761", sssd should be able to auto renew host credentials. There is no mention of any extra configuration steps that should be taken while joining the AD per related the Red Hat documentation ("Integrating Red Hat Enterprise Linux 6 with Active Directory").

Per my search, some do run cron jobs to renew host credentials "https://lists.fedorahosted.org/archives/list/[email protected]/thread/CRA43XHHDBPAENAYJ3INUWSCE2Q2NB5W/"

SSSD Kerberos AD Centos troubleshooting

Do we need a cron job to run: "msktutil --auto-update" and "kinit -k $"?

Or sssd should be able to handle this?

Do you set "ad_maximum_machine_account_password_age" in sssd.conf or leave it out for default 30 days.

Cheers,

UPDATE: @jhrozek , Thank you for your comment.
I am still seeing same issue with my configuration.
Looks like ticket did not get renewed on May 28th and server dropped out of domain:

    # net ads testjoin   
kerberos_kinit_password [email protected] failed: Preauthentication failed     
kerberos_kinit_password [email protected] failed: Preauthentication failed     
Join to domain is not valid: Logon failure    

Keytab status:

# klist -kt
Keytab name: FILE:/etc/krb5.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   2 04/28/17 02:57:54 host/[email protected]
   2 04/28/17 02:57:54 host/[email protected]
   2 04/28/17 02:57:54 host/[email protected]
   2 04/28/17 02:57:54 host/[email protected]
   2 04/28/17 02:57:54 host/[email protected]
   2 04/28/17 02:57:54 host/[email protected]
   2 04/28/17 02:57:54 host/[email protected]
   2 04/28/17 02:57:54 host/[email protected]
   2 04/28/17 02:57:55 host/[email protected]
   2 04/28/17 02:57:55 host/[email protected]
   2 04/28/17 02:57:55 [email protected]
   2 04/28/17 02:57:55 [email protected]
   2 04/28/17 02:57:55 [email protected]
   2 04/28/17 02:57:55 [email protected]
   2 04/28/17 02:57:55 [email protected]
   3 05/28/17 14:01:39 [email protected]
   3 05/28/17 14:01:39 [email protected]
   3 05/28/17 14:01:39 [email protected]
   3 05/28/17 14:01:39 [email protected]
   3 05/28/17 14:01:39 [email protected]
   3 05/28/17 14:01:39 host/[email protected]
   3 05/28/17 14:01:39 host/[email protected]
   3 05/28/17 14:01:39 host/[email protected]
   3 05/28/17 14:01:39 host/[email protected]
   3 05/28/17 14:01:39 host/[email protected]
   3 05/28/17 14:01:39 host/[email protected]
   3 05/28/17 14:01:39 host/[email protected]
   3 05/28/17 14:01:39 host/[email protected]
   3 05/28/17 14:01:39 host/[email protected]
   3 05/28/17 14:01:39 host/[email protected]

Does this look like it renewed a ticket on 5/28 but somehow got server account deleted?

SSSD & ADCLI packages installed:

# rpm -qa | grep sssd
sssd-client-1.13.3-56.el6.x86_64
sssd-ipa-1.13.3-56.el6.x86_64
sssd-proxy-1.13.3-56.el6.x86_64
python-sssdconfig-1.13.3-56.el6.noarch
sssd-common-pac-1.13.3-56.el6.x86_64
sssd-krb5-1.13.3-56.el6.x86_64
sssd-krb5-common-1.13.3-56.el6.x86_64
sssd-ldap-1.13.3-56.el6.x86_64
sssd-common-1.13.3-56.el6.x86_64
sssd-ad-1.13.3-56.el6.x86_64
sssd-1.13.3-56.el6.x86_64


# rpm -qa | grep adcli
adcli-0.8.1-1.el6.x86_64

And, sssd.conf:

[sssd]
domains = stage.example.com
services = nss, pam, ssh
config_file_version = 2
default_domain_suffix = main.example.com
full_name_format = %1$s@%2$s

re_expression = (((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))

[domain/stage.example.com
id_provider = ad
auth_provider = ad
access_provider = ad
chpass_provider = ad
cache_credentials = false
ad_domain = stage.example.com
ldap_id_mapping = true
krb5_realm = STAGE.example.com
default_shell = /bin/bash
ad_gpo_access_control = permissive
override_homedir = /home/admin/%u

And krb5.conf:

[logging]


default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = STAGE.EXAMPLE.COM
 dns_lookup_realm = true
 dns_lookup_kdc = true
 ticket_lifetime = 24h
 forwardable = true


clockskew = true
proxiable = true

[realms]

 STAGE.EXAMPLE.COM = {
  kdc = 172.31.1.252
  kdc = 172.31.0.252

  admin_server = 172.31.1.252
  admin_server = 172.31.0.252
 }

[domain_realm]
 stage.example.com = STAGE.EXAMPLE.COM
 .stage.example.com = STAGE.EXAMPLE.COM

Any suggestions to troubleshoot this?

2
  • Are you sure your Linux servers were removed from AD domain due to expired machine credentials? It shouldn't happen
    – Ra_
    Jul 31, 2019 at 6:49
  • I can't speak for the OP, but we're having the same problem and the server logs clearly indicate that the problem is a still mysterious inability to renew Kerberos tickets. This is on Ubuntu 18.04 machines.
    – pgoetz
    Sep 13, 2019 at 13:48

5 Answers 5

3

This should happen automatically, but you need to install adcli. sssd just forks and execs adcli in order to perform the update.

1
  • I found I needed adcli update --domain=MY.DOMAIN as without the qualifier it complained it couldn't derive the domain name. Jan 22, 2019 at 13:06
2

I just figured out what my problem was after having this issue for months.

I didn't name my server server.my.domain.com and instead it was just server. After changing the name, leaving and rejoining the realm, adcli update runs without a problem.

1

You may also want to configure your AD server(s) as the source of NTP time, because if your client machines' clocks get too far out of sync they will fail to authenticate/renew and this may happen a lot more often now that everything is virtualized without their own RTC hardware.

0

I have the same issue, I ended up adding the PTR record in DNS. I have identified this by:

msktutil --auto-update -verbose 

My environment contains the SSSD with Samba.

0

Also, make sure your krb5.conf sets the ticket_lifetime to the correct value. I had problems with this and it wound up being because I had ticket lifetime set to the krb5.conf default of 24 hours, while the Default Domain Policy TGT lifetime is configured for 10 hours by default. Setting ticket_lifetime = 10h was the ticket for me.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .