LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
Reload this Page [SOLVED] CentOS 7.4 - SSSD Crashes/Not Authenticating with AD
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 09-05-2018, 12:17 AM   #1
soulinlinx
LQ Newbie
 
Registered: Jan 2012
Distribution: Redhat 7/8, Ubuntu, SLES
Posts: 10

Rep: Reputation: Disabled
CentOS 7.4 - SSSD Crashes/Not Authenticating with AD

Hello Everyone -

I am using CentOS 7.4, which was restored from a 4 day old snapshot in VMware. The servers authetication was setup using AD way.
Post restoration from snapshot, the AD authentication has crashed. Below is the work i have done so far to fix, but No luck:
===========
1. Had the AD objects deleted and recreated
2. Modified PAM setting on system-auth-local and password-auth-local as below:
- session optional pam_oddjob_mkhomedir.so
#session optional pam_mkhomedir.so
3 Tried reconfiguring AD setup again, which i managed to get done positively without any error.s Still auth dint work.
===========

Request you to please assist me sorting the access, Thanks.


Below are my configs :
===========

sssd.conf:

[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam

domains = EXAMPLE.COM

[nss]
filter_groups = root, rg-xxxxx-xxx
filter_users = root, xs-xxxxx-xxx
reconnection_retries = 3
debug_level = 9

[pam]
reconnection_retries = 3
debug_level = 9

[domain/EXAMPLE.COM]
debug_level = 9
cache_credentials = False
ad_enable_gc = False
ad_maximum_machine_account_password_age = 0

id_provider = ad
auth_provider = ad
chpass_provider = ad
access_provider = ad

ldap_referrals = false

# Default AD provider does ID mapping
ldap_id_mapping = true

ldap_search_base = DC=example,DC=com

ldap_user_search_base = DC=example,DC=com
ldap_user_object_class = user

ldap_group_search_base = DC=example,DC=com
ldap_group_object_class = group

ldap_access_filter = memberOf=CN=xxxxxxxxxxxx,OU=Groups-Privileged,OU=EXAMPLE_Groups,OU=EXAMPLE_Resources,DC=EXAMPLE,DC=com
ldap_access_filter = memberOf=CN=xxxxxxxxxxxx,OU=Groups-Privileged,OU=EXAMPLE_Groups,OU=EXAMPLE_Resources,DC=EXAMPLE,DC=com

override_shell = /bin/bash
default_shell = /bin/bash
fallback_homedir = /home/%d/%u






krb5.conf
=================
[root@SRLPUPDV01 ~]# cat /etc/krb5.conf
# Other applications require this directory to perform krb5 configuration.
includedir /etc/krb5.conf.d/

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true

[realms]
MOPP.COM = {
kdc = MOPP.COM
admin_server = MOPP.COM
}

EXAMPLE.COM = {
kdc = EXAMPLE.COM
admin_server = EXAMPLE.COM
}

ZPSS.COM = {
kdc = ZPSS.COM
admin_server = ZPSS.COM
}

[domain_realm]
.mopp.COM = MOPP.COM
mopp.COM = MOPP.COM
.example.COM = EXAMPLE.COM
example.COM = EXAMPLE.COM
.zpss.COM = ZPSS.COM
zpss.COM = ZPSS.COM



/etc/pam.d/system-auth-local and password-auth-local
=====================================================
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth required pam_faillock.so preauth audit silent deny=5 even_deny_root unlock_time=900 root_unlock_time=900
auth sufficient pam_unix.so nullok try_first_pass
auth sufficient pam_sss.so use_first_pass
auth [default=die] pam_faillock.so authfail audit deny=5 even_deny_root unlock_time=900 root_unlock_time=900
auth sufficient pam_faillock.so authsucc audit deny=5
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth required pam_deny.so

account required pam_unix.so
account required pam_faillock.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so

password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=13
password sufficient pam_sss.so use_authtok
password required pam_deny.so

session optional pam_keyinit.so revoke
session required pam_limits.so
session optional pam_oddjob_mkhomedir.so
#session optional pam_mkhomedir.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so

===========================================


LOGS:
========================


/var/log/secure:
================
Sep 5 14:16:06 ABCSERVER sshd[18186]: pam_unix(sshd:auth): check pass; user unknown
Sep 5 14:16:06 ABCSERVER sshd[18186]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.11.10.1
Sep 5 14:16:06 ABCSERVER sshd[18186]: pam_sss(sshd:auth): Request to sssd failed. Connection refused
Sep 5 14:16:06 ABCSERVER sshd[18186]: pam_faillock(sshd:auth): User unknown: EXAMPLE\xs-xxxxxxx-xxxx
Sep 5 14:16:06 ABCSERVER sshd[18187]: Invalid user EXAMPLE\\xs-xxxxxxx-xxxx from 10.11.10.1 port 58354
Sep 5 14:16:06 ABCSERVER sshd[18187]: input_userauth_request: invalid user EXAMPLE\\\\xs-xxxxxxx-xxxx [preauth]
Sep 5 14:16:06 ABCSERVER sshd[18187]: pam_faillock(sshd:auth): User unknown: EXAMPLE\xs-xxxxxxx-xxxx
Sep 5 14:16:06 ABCSERVER sshd[18187]: pam_unix(sshd:auth): check pass; user unknown
Sep 5 14:16:06 ABCSERVER sshd[18187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.11.10.1
Sep 5 14:16:06 ABCSERVER sshd[18187]: pam_sss(sshd:auth): Request to sssd failed. Connection refused
Sep 5 14:16:06 ABCSERVER sshd[18187]: pam_faillock(sshd:auth): User unknown: EXAMPLE\xs-xxxxxxx-xxxx
Sep 5 14:16:08 ABCSERVER sshd[18186]: Failed password for invalid user EXAMPLE\\xs-xxxxxxx-xxxx from 10.11.10.1 port 58353 ssh2
Sep 5 14:16:08 ABCSERVER sshd[18186]: Connection closed by 10.11.10.1 port 58353 [preauth]
Sep 5 14:16:08 ABCSERVER sshd[18187]: Failed password for invalid user EXAMPLE\\xs-xxxxxxx-xxxx from 10.11.10.1 port 58354 ssh2
Sep 5 14:16:08 ABCSERVER sshd[18187]: Connection closed by 10.11.10.1 port 58354 [preauth]
Sep 5 14:16:09 ABCSERVER sshd[18191]: Invalid user EXAMPLE\\xs-xxxxxxx-xxxx from 10.11.10.1 port 58442
Sep 5 14:16:09 ABCSERVER sshd[18191]: input_userauth_request: invalid user EXAMPLE\\\\xs-xxxxxxx-xxxx [preauth]
Sep 5 14:16:09 ABCSERVER sshd[18191]: pam_faillock(sshd:auth): User unknown: EXAMPLE\xs-xxxxxxx-xxxx
Sep 5 14:16:09 ABCSERVER sshd[18191]: pam_unix(sshd:auth): check pass; user unknown
Sep 5 14:16:09 ABCSERVER sshd[18191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.11.10.1
Sep 5 14:16:09 ABCSERVER sshd[18191]: pam_sss(sshd:auth): Request to sssd failed. Connection refused
Sep 5 14:16:09 ABCSERVER sshd[18191]: pam_faillock(sshd:auth): User unknown: EXAMPLE\xs-xxxxxxx-xxxx
Sep 5 14:16:09 ABCSERVER sshd[18190]: Invalid user EXAMPLE\\xs-xxxxxxx-xxxx from 10.11.10.1 port 58441
Sep 5 14:16:09 ABCSERVER sshd[18190]: input_userauth_request: invalid user EXAMPLE\\\\xs-xxxxxxx-xxxx [preauth]
Sep 5 14:16:09 ABCSERVER sshd[18190]: pam_faillock(sshd:auth): User unknown: EXAMPLE\xs-xxxxxxx-xxxx
Sep 5 14:16:09 ABCSERVER sshd[18190]: pam_unix(sshd:auth): check pass; user unknown
Sep 5 14:16:09 ABCSERVER sshd[18190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.11.10.1
Sep 5 14:16:09 ABCSERVER sshd[18190]: pam_sss(sshd:auth): Request to sssd failed. Connection refused
Sep 5 14:16:09 ABCSERVER sshd[18190]: pam_faillock(sshd:auth): User unknown: EXAMPLE\xs-xxxxxxx-xxxx
Sep 5 14:16:11 ABCSERVER sshd[18191]: Failed password for invalid user EXAMPLE\\xs-xxxxxxx-xxxx from 10.11.10.1 port 58442 ssh2
Sep 5 14:16:11 ABCSERVER sshd[18190]: Failed password for invalid user EXAMPLE\\xs-xxxxxxx-xxxx from 10.11.10.1 port 58441 ssh2
Sep 5 14:16:11 ABCSERVER sshd[18191]: Connection closed by 10.11.10.1 port 58442 [preauth]
Sep 5 14:16:11 ABCSERVER sshd[18190]: Connection closed by 10.11.10.1 port 58441 [preauth]
Sep 5 14:16:11 ABCSERVER sshd[18195]: Invalid user EXAMPLE\\xs-xxxxxxx-xxxx from 10.11.10.1 port 58594
Sep 5 14:16:11 ABCSERVER sshd[18195]: input_userauth_request: invalid user EXAMPLE\\\\xs-xxxxxxx-xxxx [preauth]
Sep 5 14:16:12 ABCSERVER sshd[18195]: pam_faillock(sshd:auth): User unknown: EXAMPLE\xs-xxxxxxx-xxxx
Sep 5 14:16:12 ABCSERVER sshd[18195]: pam_unix(sshd:auth): check pass; user unknown
Sep 5 14:16:12 ABCSERVER sshd[18195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.11.10.1
Sep 5 14:16:12 ABCSERVER sshd[18195]: pam_sss(sshd:auth): Request to sssd failed. Connection refused
Sep 5 14:16:12 ABCSERVER sshd[18195]: pam_faillock(sshd:auth): User unknown: EXAMPLE\xs-xxxxxxx-xxxx
Sep 5 14:16:12 ABCSERVER sshd[18196]: Invalid user EXAMPLE\\xs-xxxxxxx-xxxx from 10.11.10.1 port 58595
Sep 5 14:16:12 ABCSERVER sshd[18196]: input_userauth_request: invalid user EXAMPLE\\\\xs-xxxxxxx-xxxx [preauth]
Sep 5 14:16:12 ABCSERVER sshd[18196]: pam_faillock(sshd:auth): User unknown: EXAMPLE\xs-xxxxxxx-xxxx
Sep 5 14:16:12 ABCSERVER sshd[18196]: pam_unix(sshd:auth): check pass; user unknown
Sep 5 14:16:12 ABCSERVER sshd[18196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.11.10.1
Sep 5 14:16:12 ABCSERVER sshd[18196]: pam_sss(sshd:auth): Request to sssd failed. Connection refused
Sep 5 14:16:12 ABCSERVER sshd[18196]: pam_faillock(sshd:auth): User unknown: EXAMPLE\xs-xxxxxxx-xxxx
Sep 5 14:16:14 ABCSERVER sshd[18196]: Failed password for invalid user EXAMPLE\\xs-xxxxxxx-xxxx from 10.11.10.1 port 58595 ssh2
Sep 5 14:16:14 ABCSERVER sshd[18196]: Connection closed by 10.11.10.1 port 58595 [preauth]
Sep 5 14:16:14 ABCSERVER sshd[18195]: Failed password for invalid user EXAMPLE\\xs-xxxxxxx-xxxx from 10.11.10.1 port 58594 ssh2
Sep 5 14:16:14 ABCSERVER sshd[18195]: Connection closed by 10.11.10.1 port 58594 [preauth]
Sep 5 14:16:15 ABCSERVER sshd[18199]: Invalid user EXAMPLE\\xs-xxxxxxx-xxxx from 10.11.10.1 port 59064
Sep 5 14:16:15 ABCSERVER sshd[18199]: input_userauth_request: invalid user EXAMPLE\\\\xs-xxxxxxx-xxxx [preauth]
Sep 5 14:16:15 ABCSERVER sshd[18199]: pam_faillock(sshd:auth): User unknown: EXAMPLE\xs-xxxxxxx-xxxx
Sep 5 14:16:15 ABCSERVER sshd[18199]: pam_unix(sshd:auth): check pass; user unknown
Sep 5 14:16:15 ABCSERVER sshd[18199]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.11.10.1
Sep 5 14:16:15 ABCSERVER sshd[18199]: pam_sss(sshd:auth): Request to sssd failed. Connection refused
Sep 5 14:16:15 ABCSERVER sshd[18199]: pam_faillock(sshd:auth): User unknown: EXAMPLE\xs-xxxxxxx-xxxx
Sep 5 14:16:17 ABCSERVER sshd[18199]: Failed password for invalid user EXAMPLE\\xs-xxxxxxx-xxxx from 10.11.10.1 port 59064 ssh2
Sep 5 14:16:17 ABCSERVER sshd[18199]: Connection closed by 10.11.10.1 port 59064 [preauth]




Thanks
 
Old 09-05-2018, 12:21 AM   #2
soulinlinx
LQ Newbie
 
Registered: Jan 2012
Distribution: Redhat 7/8, Ubuntu, SLES
Posts: 10

Original Poster
Rep: Reputation: Disabled
Additonal Info - sssd.log
Attaching the sssd logs for details:
===================

- sssd_EXAMPLE.COM.log


(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [child_sig_handler] (0x1000): Waiting for child [20919].
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [child_sig_handler] (0x0100): child [20919] finished successfully.
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [be_nsupdate_done] (0x0200): nsupdate child status: 0
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [nsupdate_msg_create_common] (0x0200): Creating update message for auto-discovered realm.
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [be_nsupdate_create_ptr_msg] (0x0400): -- Begin nsupdate message --

update delete 41.16.184.10.in-addr.arpa. in PTR
send
-- End nsupdate message --
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [write_pipe_handler] (0x0400): All data has been sent!
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [nsupdate_child_stdin_done] (0x1000): Sending nsupdate data complete
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [be_nsupdate_args] (0x0200): nsupdate auth type: GSS-TSIG
Reply from SOA query:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48166
;; flags: qr aa rd ra; QUESTION: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;41.16.184.10.in-addr.arpa. IN SOA

;; AUTHORITY SECTION:
184.10.in-addr.arpa. 3600 IN SOA Serverdr05.example.com. hostmaster.example.com. 619 900 600 86400 3600

;; ADDITIONAL SECTION:
Serverdr05.example.com. 3600 IN A 10.19.11.4

Found zone name: 184.10.in-addr.arpa
The master is: Serverdr05.example.com
start_gssrequest
send_gssrequest
recvmsg reply from GSS-TSIG query
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46604
;; flags: qr; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; QUESTION SECTION:
;332930545.sig-Serverdr05.example.com. ANY TKEY

;; ANSWER SECTION:
332930545.sig-Serverdr05.example.com. 0 ANY TKEY gss-tsig. 1536122878 1536209278 3 NOERROR 156 YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKi cQRvAgA9KZlPYQLCroyomrsG9aqEKv96pbxQht2F/CG3HkNlSebXqdt8 rxR5vxyeeQ3E1Bd/uZDqXmq6b7b67bK0ICo92D3Yt+LGAf8YlFxNbq/b /lfUo4s06rp6OPdQkcYohODInBKZ3eWUH3fXiebl 0

;; TSIG PSEUDOSECTION:
332930545.sig-Serverdr05.example.com. 0 ANY TSIG gss-tsig. 1536122878 36000 28 BAQF//////8AAAAAOHwaR+llQjFHM4f++20jIA== 46604 NOERROR 0

Sending update to 10.19.11.4#53
; TSIG error with server: tsig verify failure

Reply from update query:
;; ->>HEADER<<- opcode: UPDATE, status: REFUSED, id: 55624
;; flags: qr; ZONE: 1, PREREQ: 0, UPDATE: 1, ADDITIONAL: 1
;; ZONE SECTION:
;184.10.in-addr.arpa. IN SOA

;; UPDATE SECTION:
41.16.184.10.in-addr.arpa. 0 ANY PTR

;; TSIG PSEUDOSECTION:
332930545.sig-Serverdr05.example.com. 0 ANY TSIG gss-tsig. 1536122875 300 28 BAQE//////8AAAAABpQKa8ZJPcGlMIcZk9M8/w== 55624 NOERROR 0

(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [child_sig_handler] (0x1000): Waiting for child [20923].
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [child_sig_handler] (0x0020): child [20923] failed with status [2].
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [nsupdate_child_handler] (0x0040): Dynamic DNS child failed with status [512]
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [be_nsupdate_done] (0x0040): nsupdate child execution failed [1432158239]: Dynamic DNS update failed
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [sdap_dyndns_update_ptr_done] (0x0080): nsupdate failed, retrying
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [nsupdate_msg_create_common] (0x0200): Creating update message for realm [example.com].
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [be_nsupdate_create_ptr_msg] (0x0400): -- Begin nsupdate message --
realm example.com
update delete 41.16.184.10.in-addr.arpa. in PTR
send
-- End nsupdate message --
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [write_pipe_handler] (0x0400): All data has been sent!
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [nsupdate_child_stdin_done] (0x1000): Sending nsupdate data complete
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [be_nsupdate_args] (0x0200): nsupdate auth type: GSS-TSIG
Reply from SOA query:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58763
;; flags: qr aa rd ra; QUESTION: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;41.16.184.10.in-addr.arpa. IN SOA

;; AUTHORITY SECTION:
184.10.in-addr.arpa. 3600 IN SOA Serverdr05.example.com. hostmaster.example.com. 619 900 600 86400 3600

;; ADDITIONAL SECTION:
Serverdr05.example.com. 3600 IN A 10.19.11.4

Found zone name: 184.10.in-addr.arpa
The master is: Serverdr05.example.com
start_gssrequest
send_gssrequest
recvmsg reply from GSS-TSIG query
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26509
;; flags: qr; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; QUESTION SECTION:
;1293920283.sig-Serverdr05.example.com. ANY TKEY

;; ANSWER SECTION:
1293920283.sig-Serverdr05.example.com. 0 ANY TKEY gss-tsig. 1536122878 1536209278 3 NOERROR 156 YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKi cQRvXocF4FeQ9RcgV0g1wYdTWPDYJlKR/G93xYqkDQJ1/Wtt7TbIm97b OguKqeuLokU2EkhpWXIMtVLa0Z+9Yw1XIMPMgsjmv8hUofhgkdaUWw82 KuwksjWQZvyUn1nwaLx3CkJJvxa7xf9iESpo1tH3 0

;; TSIG PSEUDOSECTION:
1293920283.sig-Serverdr05.example.com. 0 ANY TSIG gss-tsig. 1536122878 36000 28 BAQF//////8AAAAAOFo+KRwnVQrVXSPgnMRRAg== 26509 NOERROR 0

Sending update to 10.19.11.4#53
; TSIG error with server: tsig verify failure

Reply from update query:
;; ->>HEADER<<- opcode: UPDATE, status: REFUSED, id: 38950
;; flags: qr; ZONE: 1, PREREQ: 0, UPDATE: 1, ADDITIONAL: 1
;; ZONE SECTION:
;184.10.in-addr.arpa. IN SOA

;; UPDATE SECTION:
41.16.184.10.in-addr.arpa. 0 ANY PTR

;; TSIG PSEUDOSECTION:
1293920283.sig-Serverdr05.example.com. 0 ANY TSIG gss-tsig. 1536122875 300 28 BAQE//////8AAAAAEyTgMCKTzaXmaEML7VJ9sw== 38950 NOERROR 0

(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [child_sig_handler] (0x1000): Waiting for child [20927].
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [child_sig_handler] (0x0020): child [20927] failed with status [2].
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [nsupdate_child_handler] (0x0040): Dynamic DNS child failed with status [512]
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [be_nsupdate_done] (0x0040): nsupdate child execution failed [1432158239]: Dynamic DNS update failed
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [nsupdate_msg_create_common] (0x0200): Creating update message for auto-discovered realm.
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [be_nsupdate_create_ptr_msg] (0x0400): -- Begin nsupdate message --

update add 41.16.184.10.in-addr.arpa. 3600 in PTR ABCSERVER.example.com.
send
-- End nsupdate message --
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [write_pipe_handler] (0x0400): All data has been sent!
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [nsupdate_child_stdin_done] (0x1000): Sending nsupdate data complete
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [be_nsupdate_args] (0x0200): nsupdate auth type: GSS-TSIG
Reply from SOA query:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10398
;; flags: qr aa rd ra; QUESTION: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;41.16.184.10.in-addr.arpa. IN SOA

;; AUTHORITY SECTION:
184.10.in-addr.arpa. 3600 IN SOA Serverdr05.example.com. hostmaster.example.com. 619 900 600 86400 3600

;; ADDITIONAL SECTION:
Serverdr05.example.com. 3600 IN A 10.19.11.4

Found zone name: 184.10.in-addr.arpa
The master is: Serverdr05.example.com
start_gssrequest
send_gssrequest
recvmsg reply from GSS-TSIG query
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56983
;; flags: qr; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; QUESTION SECTION:
;2994557421.sig-Serverdr05.example.com. ANY TKEY

;; ANSWER SECTION:
2994557421.sig-Serverdr05.example.com. 0 ANY TKEY gss-tsig. 1536122878 1536209278 3 NOERROR 156 YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKi cQRvWoCMgxb8p1Eqp9RmHM9NPM/XIQLOO0HFhF+cYmMINYacZtAecH3W SR9c/XuI+UBVxv3cl9vBi2Mqdxq6sn+Yvn7043nr6Ac2HLDKm+YQ+hcx ABX0SsSA+E0HpgxQOaKa0hpAGOwm6EOFQYl2l6JW 0

;; TSIG PSEUDOSECTION:
2994557421.sig-Serverdr05.example.com. 0 ANY TSIG gss-tsig. 1536122878 36000 28 BAQF//////8AAAAAODbLMZokReYOJmRSHaKGaw== 56983 NOERROR 0

Sending update to 10.19.11.4#53

Reply from update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 61784
;; flags: qr; ZONE: 1, PREREQ: 0, UPDATE: 1, ADDITIONAL: 1
;; ZONE SECTION:
;184.10.in-addr.arpa. IN SOA

;; UPDATE SECTION:
41.16.184.10.in-addr.arpa. 3600 IN PTR ABCSERVER.example.com.

;; TSIG PSEUDOSECTION:
2994557421.sig-Serverdr05.example.com. 0 ANY TSIG gss-tsig. 1536122878 36000 28 BAQF//////8AAAAAODbLMiZI+2Buvd4PE+EuNA== 61784 NOERROR 0

(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [child_sig_handler] (0x1000): Waiting for child [20931].
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [child_sig_handler] (0x0100): child [20931] finished successfully.
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [be_nsupdate_done] (0x0200): nsupdate child status: 0
(Wed Sep 5 14:47:55 2018) [sssd[be[example.com]]] [ad_dyndns_nsupdate_done] (0x0400): DNS update finished
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_server_init_new_connection] (0x0200): Entering.
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_server_init_new_connection] (0x0200): Adding connection 0x55c3ce544f00.
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_init_connection] (0x0400): Adding connection 0x55c3ce544f00
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_server_init_new_connection] (0x0200): Got a connection
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [dp_client_init] (0x0100): Set-up Backend ID timeout [0x55c3ce547100]
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.sssd.DataProvider.Client with path /org/freedesktop/sssd/dataprovider
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_conn_register_path] (0x0400): Registering object path /org/freedesktop/sssd/dataprovider with D-Bus connection
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.DBus.Properties with path /org/freedesktop/sssd/dataprovider
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.DBus.Introspectable with path /org/freedesktop/sssd/dataprovider
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.sssd.dataprovider with path /org/freedesktop/sssd/dataprovider
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.sssd.DataProvider.Backend with path /org/freedesktop/sssd/dataprovider
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.sssd.DataProvider.Failover with path /org/freedesktop/sssd/dataprovider
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.sssd.DataProvider.AccessControl with path /org/freedesktop/sssd/dataprovider
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_server_init_new_connection] (0x0200): Entering.
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_server_init_new_connection] (0x0200): Adding connection 0x55c3ce55dcf0.
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_init_connection] (0x0400): Adding connection 0x55c3ce55dcf0
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_server_init_new_connection] (0x0200): Got a connection
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [dp_client_init] (0x0100): Set-up Backend ID timeout [0x55c3ce536450]
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.sssd.DataProvider.Client with path /org/freedesktop/sssd/dataprovider
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_conn_register_path] (0x0400): Registering object path /org/freedesktop/sssd/dataprovider with D-Bus connection
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.DBus.Properties with path /org/freedesktop/sssd/dataprovider
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.DBus.Introspectable with path /org/freedesktop/sssd/dataprovider
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.sssd.dataprovider with path /org/freedesktop/sssd/dataprovider
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.sssd.DataProvider.Backend with path /org/freedesktop/sssd/dataprovider
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.sssd.DataProvider.Failover with path /org/freedesktop/sssd/dataprovider
(Wed Sep 5 14:48:04 2018) [sssd[be[example.com]]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.sssd.DataProvider.AccessControl with path /org/freedesktop/sssd/dataprovider

(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gPLink]
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gpOptions]
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_parse_entry] (0x1000): OriginalDN: [OU=DEV,OU=Linux,OU=QS SERVERS - Non Windows,DC=example,DC=com].
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_parse_entry] (0x1000): Entry has no attributes [0(Success)]!?
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [ad_gpo_get_som_attrs_done] (0x0040): no attrs found for SOM; try next SOM
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][OU=Linux,OU=QS SERVERS - Non Windows,DC=example,DC=com].
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gPLink]
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gpOptions]
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_parse_entry] (0x1000): OriginalDN: [OU=Linux,OU=QS SERVERS - Non Windows,DC=example,DC=com].
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_parse_entry] (0x1000): Entry has no attributes [0(Success)]!?
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [ad_gpo_get_som_attrs_done] (0x0040): no attrs found for SOM; try next SOM
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][OU=QS SERVERS - Non Windows,DC=example,DC=com].
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gPLink]
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gpOptions]
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_parse_entry] (0x1000): OriginalDN: [OU=QS SERVERS - Non Windows,DC=example,DC=com].
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_parse_entry] (0x1000): Entry has no attributes [0(Success)]!?
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [ad_gpo_get_som_attrs_done] (0x0040): no attrs found for SOM; try next SOM
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][DC=example,DC=com].
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gPLink]
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gpOptions]
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_parse_entry] (0x1000): OriginalDN: [DC=example,DC=com].
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [ad_gpo_populate_gplink_list] (0x0400): som_dn: DC=example,DC=com
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][cn=DRSite,cn=Sites,CN=Configuration,DC=corp,DC=root].
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gPLink]
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gpOptions]
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_parse_entry] (0x1000): OriginalDN: [cn=DRSite,cn=Sites,CN=Configuration,DC=corp,DC=root].
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_parse_entry] (0x1000): Entry has no attributes [0(Success)]!?
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [ad_gpo_get_som_attrs_done] (0x0040): no attrs found for SOM; try next SOM
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[0]->gpo_dn: CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=example,DC=com
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_sd_search_send] (0x0400): Searching entry [CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=example,DC=com] using SD
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base.
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=example,DC=com].
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [nTSecurityDescriptor]
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [cn]
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gPCFileSysPath]
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gPCMachineExtensionNames]
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gPCFunctionalityVersion]
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [flags]
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=example,DC=com].
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Wed Sep 5 14:48:09 2018) [sssd[be[example.com]]] [talloc_log_fn] (0x0010): Bad talloc magic value - unknown value
 
Old 09-06-2018, 10:28 PM   #3
soulinlinx
LQ Newbie
 
Registered: Jan 2012
Distribution: Redhat 7/8, Ubuntu, SLES
Posts: 10

Original Poster
Rep: Reputation: Disabled
Nevermind guys, i sorted this out myself, added below entry in sssd.conf

use_fully_qualified_names = False

Thanks
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Any way to remove domain name at end of username when authenticating with ldap (sssd)? shuey79 Linux - Newbie 15 05-05-2022 01:16 PM
CentOS 6.7 SSSD failed password vikas027 Linux - Server 0 12-13-2015 06:45 AM
Centos 6.5 SSSD / Kerberos and password changes rocker65 Linux - Desktop 1 10-16-2014 02:13 PM
Specifying LDAP password format for SSSD in CentOS 6.2 TomL Linux - Enterprise 3 06-27-2012 06:09 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:33 PM.

Contact Us - Advertising Info - Rules - Privacy - LQ Merchandise - Donations - Contributing Member - LQ Sitemap -
Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration