This makes sense. adcli update, with the Kerberos creds of the original
principal that's allowed to create new machine accounts in that OU in the
first place.
As it turns out, I must have powered up that VM just under the wire. (I
believe our AD policy is to lock machine accounts after 40 days.) So once
I powered it up, I had to come in as root and do a 'systemctl restart
sssd', then all was good. And still is good.
I didn't have to re-joint or update machine password after all.
Spike
On Tue, Oct 9, 2018 at 3:33 AM John Hearns <hearnsj(a)googlemail.com> wrote:
Spike, the machine will always have an account in the AD Realm.
So no, you do not have to leave and re-join. What DOES time out is the
password.
sssd should renew the password periodcially (*) when it is running. As
you say you have had > 30 days of downtime
You can use the msktutil to reset a password
https://fuhm.net/software/msktutil/manpage.html#PASSWORD EXPIRY
(*) you can change this periddicity in sssd - and can turn it down to
a very shirt time, for debugging.
One of the parameters is also 'how soon after startup should I look at
the age of the password
On Mon, 8 Oct 2018 at 15:16, Spike White <spikewhitetx(a)gmail.com> wrote:
>
> All,
>
> I had a VM down for a great number of days. Apparently, it was not 30
days. Because even though it initially didn't correct do AD
authentication, I fixed one misconfiguration in /etc/krb5.conf, restarted
SSSD and it did.
>
> But that raises a bigger question. If it's been >30 days and my machine
account is no longer valid, how do I rejoin the domain?
>
> Is it:
> realm leave (no flags)
> readlm join (with all my usual flags that I use on the initial realm
join)
>
> Spike
> _______________________________________________
> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahoste...
_______________________________________________
sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahoste...