6

I have an issue with Linux clients trying to AD authentication by targeting a DNS name (corp.example.com). I have 2 Domain Controller servers DC1(10.0.0.3/24), DC2(10.1.0.3/24) both domain controllers for corp.example.com. Before starting this each Linux client had 1 of the 2 AD servers IP addresses explicitly defined on it. I went through and replaced the IP address with the Domain name (corp.example.com) as shown below in the configs. Tested it and it works great. However, testing failover by turning off one of the Dome Controller servers renders some Linux clients unable to authenticate and times out. See DC/DNS failover with global/common DNS roundrobin for my originally post when I thought it was an network issue. On the Linux clients:

/etc/openldap/ldap.conf

  uri     ldap://DC1 ldap://DC2
    base    dc=corp,dc=example,dc=com

/etc/krb5.conf

[libdefaults]
        default_realm = corp.example.com
        clockskew = 300
        dns_lookup_kdc
#       default_realm = EXAMPLE.COM

[realms]
corp.example.com= {
        kdc = corp.example.com
        default_domain = corp.example.com
        kpasswd_server = corp.example.com
        admin_server = corp.example.com
}
#       EXAMPLE.COM = {
#                kdc = kerberos.example.com
#               admin_server = kerberos.example.com
#       }

[logging]
        kdc = FILE:/var/log/krb5/krb5kdc.log
        admin_server = FILE:/var/log/krb5/kadmind.log
        default = SYSLOG:NOTICE:DAEMON
[domain_realm]
        .corp.example.com = corp.example.com
        .corp = corp.example.com
[appdefaults]
pam = {
        ticket_lifetime = 1d
        renew_lifetime = 1d
        forwardable = true
        proxiable = false
        minimum_uid = 1
        external = sshd
        use_shmem = sshd
        clockskew = 300
        retain_after_close = false
}

/etc/resolve.conf

search corp.example.com
nameserver 10.0.0.3
nameserver 10.1.0.3

This is what I see in the syslog-ng

Nov 30 09:04:56 linux_client nscd: nss_ldap: failed to bind to LDAP server ldap://ad3: Can't contact LDAP server
Nov 30 09:04:59 linux_client sshd[15585]: nss_ldap: failed to bind to LDAP server ldap://ad3: Can't contact LDAP server
Nov 30 08:50:19 linux_client sshd[15242]: Accepted keyboard-interactive/pam for jim from 10.0.0.231 port 61288 ssh2
Nov 30 08:52:02 linux_client sshd[15284]: nss_ldap: could not search LDAP server - Server is unavailable
Nov 30 08:53:09 linux_client sshd[15284]: pam_unix2(sshd:auth): conversation failed
Nov 30 08:53:16 linux_client sshd[15284]: error: ssh_msg_send: write
Nov 30 08:53:26 linux_client sshd[15284]: pam_krb5[15284]: authentication fails for 'jim' ([email protected]): Authentication failure (Cannot read password)
Nov 30 08:53:26 linux_client sshd[15284]: error: ssh_msg_send: write
Nov 30 08:56:02 linux_client sshd[15289]: nss_ldap: could not search LDAP server - Server is unavailable
Nov 30 08:56:27 linux_client sshd[15289]: pam_krb5[15289]: authentication succeeds for 'jim' ([email protected])
Nov 30 08:57:12 linux_client sshd[15289]: nss_ldap: could not search LDAP server - Server is unavailable
Nov 30 08:57:18 linux_client sshd[15289]: _rebind_proc
Nov 30 08:57:31 linux_client sshd[15289]: _rebind_proc
Nov 30 08:57:34 linux_client sshd[15289]: _rebind_proc
Nov 30 08:57:34 linux_client sshd[15289]: pam_ldap: ldap_result Timed out
Nov 30 08:57:34 linux_client sshd[15289]: error: ssh_msg_send: write

I looks like it is not trying the other DCs?

3
  • The DC's are in different subnets. Can the Linux clients reach and communicate with both subnets?
    – joeqwerty
    Nov 29, 2012 at 21:27
  • Yes,there is a router between.
    – Jim
    Nov 30, 2012 at 13:51
  • "ldap://ad3: Can't contact LDAP server" where does this hostname come from? I only see DC1 and DC2 in your configs.
    – Flamewires
    Aug 20, 2016 at 17:32

1 Answer 1

0

Instead of using DNS to fail-over your domain controllers, /etc/openldap/ldap.conf allows you to use a space separated list of ldap servers. You can still use host names instead of actual IP addresses as well.

For example: URI ldap://dc01.corp.example.com ldap://dc02.corp.example.com

For more information see: http://linux.die.net/man/5/ldap.conf

I also noticed your 2 IP addresses from above are in separate subnets. Make sure your clients have comms to both. You have already looked into network issues so you are probably fine but I wanted to mention it just in case.

5
  • 1
    Tried URI ldap://DC1 ldap://DC2, which works when DC1 is accessible, but not when I turn off DC1 to test failover it times out when authenticating.
    – Jim
    Nov 30, 2012 at 13:53
  • Now tried URI ldap://10.0.0.3 ldap://10.1.0.3, but still doesn't work when 10.0.0.3 is unavailable. Logs show it keeps trying to contact ldap://10.0.0.3?? Is there a parameter I have to set in ldap.conf to have it try other ldap servers?
    – Jim
    Nov 30, 2012 at 14:21
  • 1
    try setting the bind_timelimit <timelimit> I have not had to do that before but it is worth testing/researching.
    – Brian W
    Nov 30, 2012 at 19:17
  • 1
    This is less desirable than DNS, as it involves editing configs on all the clients whenever you add or remove domain controllers.
    – Joel Coel
    Oct 6, 2015 at 18:26
  • linuxquestions.org/questions/linux-enterprise-47/… mentions a few other settings as well
    – erik258
    Jan 6, 2017 at 0:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .