I am trying to get Rockey Linux to authenticate to Active Directory for a home lab. I followed this guide but no luck
The Rockey server is able to ping the windows server and resolve it by IP and domain name. I was able to join the Linux server to AD but unable to login as using an AD account. The SSSD service Is giving me an GSSAPI Error unspecified GSS failure.
I am a bit over my head on this one. Where to start?
/etc/sssd/sssd.conf
[sssd]
domains = example.local
config_file_version = 2
services = nss, pam
default_domain_suffix = example.local
[nss]
homedir_substring = /home
[domain/example.local]
ad_server = example.local
ad_domain = example.local
krb5_realm = EXAMPLE.LOCAL
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
ad_hostname = WIN-CTJ8UV55N1T
dyndns_update = true
dyndns_refresh_interval = 43200
dyndns_update_ptr = true
dyndns_ttl = 3600
dyndns_auth = GSS-TSIG
Have you checked the sssd logs?
/var/log/sssd
You can also put ‘debug_level=N’ into the sections of the conf file to get more detail.
I did notice that I am getting GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)
Still looking in to that.
022-03-06 14:39:12): [be[example.local]] [ad_subdomains_refresh_connect_done] (0x0020): [RID#71] Unable to connect to LDAP [11]: Resource temporarily unavailable
(2022-03-06 14:39:12): [be[example.local]] [ad_subdomains_refresh_connect_done] (0x0080): [RID#71] No AD server is available, cannot get the subdomain list while offline
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_done] (0x0040): [RID#71] Task [Subdomains Refresh]: failed with [1432158212]: SSSD is offline
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_schedule] (0x0400): [RID#71] Task [Subdomains Refresh]: scheduling task 14400 seconds from now [1646613552]
(2022-03-06 14:39:12): [be[example.local]] [sdap_id_release_conn_data] (0x4000): [RID#71] Releasing unused connection with fd [-1]
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_online_cb] (0x0400): [RID#71] Back end is online
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_enable] (0x0400): [RID#71] Task [SUDO Smart Refresh]: enabling task
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_schedule] (0x0400): [RID#71] Task [SUDO Smart Refresh]: scheduling task 900 seconds from now [1646600052]
(2022-03-06 14:39:12): [be[example.local]] [remove_krb5_info_files] (0x0200): [RID#71] Could not remove [/var/lib/sss/pubconf/kpasswdinfo.EXAMPLE.LOCAL], [2][No such file or directory]
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_online_cb] (0x0400): [RID#71] Back end is online
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_enable] (0x0400): [RID#71] Task [SUDO Full Refresh]: enabling task
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_schedule] (0x0400): [RID#71] Task [SUDO Full Refresh]: scheduling task 0 seconds from now [1646599152]
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_execute] (0x0400): [RID#71] Back end is offline
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_disable] (0x0400): [RID#71] Task [SUDO Full Refresh]: disabling task
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_offline_cb] (0x0400): [RID#71] Back end is offline
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_disable] (0x0400): [RID#71] Task [Subdomains Refresh]: disabling task
(2022-03-06 14:39:12): [be[example.local]] [sdap_sudo_online_cb] (0x0400): [RID#71] We are back online. SUDO host information will be renewed on next refresh.
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_offline_cb] (0x0400): [RID#71] Back end is offline
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_disable] (0x0400): [RID#71] Task [SUDO Smart Refresh]: disabling task
(2022-03-06 14:39:12): [be[example.local]] [delayed_online_authentication_callback] (0x0200): [RID#71] Backend is online, starting delayed online authentication.
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_offline_cb] (0x0400): [RID#71] Back end is offline
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_disable] (0x0400): [RID#71] Task [SUDO Full Refresh]: disabling task
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_online_cb] (0x0400): [RID#71] Back end is online
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_enable] (0x0400): [RID#71] Task [AD machine account password renewal]: enabling task
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_schedule] (0x0400): [RID#71] Task [AD machine account password renewal]: scheduling task 0 seconds from now [1646599152]
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_execute] (0x0400): [RID#71] Back end is offline
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_disable] (0x0400): [RID#71] Task [AD machine account password renewal]: disabling task
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_offline_cb] (0x0400): [RID#71] Back end is offline
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_disable] (0x0400): [RID#71] Task [AD machine account password renewal]: disabling task
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_online_cb] (0x0400): [RID#71] Back end is online
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_enable] (0x0400): [RID#71] Task [Dyndns update]: enabling task
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_schedule] (0x0400): [RID#71] Task [Dyndns update]: scheduling task 0 seconds from now [1646599152]
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_execute] (0x0400): [RID#71] Back end is offline
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_disable] (0x0400): [RID#71] Task [Dyndns update]: disabling task
(2022-03-06 14:39:12): [be[example.local]] [ad_online_cb] (0x0400): [RID#71] The AD provider is online
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_offline_cb] (0x0400): [RID#71] Back end is offline
(2022-03-06 14:39:12): [be[example.local]] [be_ptask_disable] (0x0400): [RID#71] Task [Dyndns update]: disabling task
(2022-03-06 14:39:56): [be[example.local]] [sbus_dispatch] (0x4000): Dispatching.
(2022-03-06 14:39:56): [be[example.local]] [sbus_dispatch] (0x4000): Dispatching.
(2022-03-06 14:39:56): [be[example.local]] [sbus_method_handler] (0x2000): Received D-Bus method sssd.dataprovider.getAccountInfo on /sssd
(2022-03-06 14:39:56): [be[example.local]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.nss]
(2022-03-06 14:39:56): [be[example.local]] [dp_get_account_info_send] (0x0200): Got request for [0x2][BE_REQ_GROUP][name=tty@example.local]
(2022-03-06 14:39:56): [be[example.local]] [dp_attach_req] (0x0400): [RID#72] DP Request [Account #72]: REQ_TRACE: New request. [sssd.nss CID #21] Flags [0x0001].
(2022-03-06 14:39:56): [be[example.local]] [dp_attach_req] (0x0400): [RID#72] Number of active DP request: 1
(2022-03-06 14:39:56): [be[example.local]] [sss_domain_get_state] (0x1000): [RID#72] Domain example.local is Active
I did some more searching and found a guide on the Rockey Linux site. Needless to say, I got Rockey to join Windows AD and now I am able to login as using AD.
do you have a link to the guide please?