2

Environment:

  • ~400 Servers enrolled in Prod IPA
  • Prod IPA setup as Master/Master replication between two servers

Around 4:40 PM yesterday users started reporting unable to login to servers via SSH. Sysadmins were able to login via sshkey.

Client logs only said "Authentication failed, Invalid password" or "Unable to Authenticate"

IPA server logs didn't say anything besides lines similar to the following for users and hosts:

Sep 28 17:51:24 hostname123 krb5kdc[2134](info): AS_REQ (4 etypes {18 17 16 23}) 192.111.1.111: NEEDED_PREAUTH: host/hostname123.domain.domain.com@REALM.DOMAIN.COM for krbtgt/REALM.DOMAIN.COM@REALM.DOMAIN.COM, Additional pre-authentication required

We restarted IPA on both machines, rebooted the VM's, etc with no fix. Only fix was to go into every client machine and sss_cache -E;rm -rf /var/lib/sss/db/*;

After this users were able to login via puTTy.

Anyone face any similar issue? Our main sysadmin who setup this system years ago is no longer with us and this was our first major issue.

Note: also all IPA commands stopped working on the IPA server around this time. Ex.:

ipa user-show xxxx ("ipa: ERROR: cannot connect to Gettext('any of the configured servers', domain='ipa', localedir=None)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.