Rocky 10: "No KCM server found" via SSH login to Samba AD DC

Rocky Linux Help & Support
1

I have a Raspberry Pi 4 at my dad’s house running Rocky Linux 10. The Pi 4 is behind a MikroTik router which hosts a Wireguard VPN to my home’s MikroTik.

I’m connecting my Pi to a FreeBSD 15 Samba domain controller. However, I am using sssd on the Rocky systems. I can join just fine on the Pi.

The problem is, whenever I log in via SSH, I get a “No KCM server found” error.

Feb 09 13:30:48 pibaba.sc.lan systemd[1]: Started sssd.service - System Security Services Daemon.
Feb 09 13:30:59 pibaba.sc.lan krb5_child[1178]: No KCM server found
Feb 09 13:30:59 pibaba.sc.lan sshd-session[1174]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.20.254.3 user=blackbird
Feb 09 13:30:59 pibaba.sc.lan sshd-session[1174]: pam_sss(sshd:auth): received for user blackbird: 4 (System error)
Feb 09 13:31:01 pibaba.sc.lan sshd-session[1174]: Failed password for blackbird from 172.20.254.3 port 45184 ssh2
Feb 09 13:31:05 pibaba.sc.lan sshd-session[1174]: Connection closed by authenticating user blackbird 172.20.254.3 port 45184 [preauth]

Is there a solution for this? Or is a reinstall necessary?

In the past it worked fine. I tried leaving the domain, removing the Pi from the DC, and re-joining. Using su to the user works fine, but obviously that’s a bad solution.

I can join my homelab’s Minisforum MS-01 clusters (both running Rocky 10) fine via SSSD/AD.

I’m considering switching to a HP EliteDesk to replace the Pi at my dad’s just for vPro/AMT.

2

You need to review /var/log/sssd/krb5_child.log to see where the issue is. SSSD is clearly reporting a system error, which means you may also need to debug sssd to see where the hold up is if krb5_child.log doesn’t tell you what you need to know.

3

What you didn’t say is where the logs originate, if they are on the DC, then A) you shouldn’t be using sssd with Samba and B) Samba does not have a KCM. If it is on the client, then you need to install the sssd KCM package.