5:52 a.m.
Hello,
I've been trying to get this working for several weeks now, but the
kerberos tickets keep expiring after 7 days.
They just expired again today. I think I have set up everything correctly,
but it still doesn't seem to work.
I hope someone on this list can point me in the right direction.
Below is some more information.
The machine is joined to an Active Directory realm with net ads join -k.
[root@hostname ~] cat /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
[realms]
# Define only if DNS lookups are not working
# example.com = {
# kdc = DC01
# admin_server = DC01.example.com
# }
# EXAMPLE.COM = {
# kdc = DC01.example.com
# kdc = DC02.example.com
# kdc = DC03.example.com
# kdc = DC04.example.com
# }
[domain_realm]
# Define only if DNS lookups are not working
# .brain.com = EXAMPLE.COM
# example.com = EXAMPLE.COM
[root@hostname ~] cat /etc/samba/smb.conf
#removed commented lines
[global]
security = ads
passdb backend = tdbsam
realm = EXAMPLE.COM
password server = dc01.example.com dc02.example.com
kerberos method = secrets and keytab
client signing = yes
client use spnego = yes
load printers = yes
cups options = raw
[homes]
comment = Home Directories
browseable = no
writable = yes
[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
guest ok = no
writable = no
printable = yes
[root@hostname ~] cat /etc/sssd/sssd.conf
[sssd]
domains = example.com
config_file_version = 2
services = nss, pam, pac, sudo, autofs
debug_level = 6
[nss]
debug_level = 3
[pam]
debug_level = 3
[sudo]
debug_level = 3
[autofs]
debug_level = 3
[domain/example.com]
debug_level = 6
ad_domain = example.com
ad_hostname = hostname.example.com
krb5_realm = EXAMPLE.COM
cache_credentials = True
id_provider = ad
auth_provider = krb5
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = False
fallback_homedir = /home/users/%u
access_provider = ad
# LDAP settings
ldap_schema = rfc2307bis
# Unless you know you need referrals, turn them off
ldap_referrals = false
# Uncomment if you need offline logins
# cache_credentials = true
enumerate = false
ldap_sasl_mech = GSSAPI
ldap_user_search_base = ou=Brain2HQ,dc=brain2,dc=com
ldap_user_object_class = user
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName
ldap_group_search_base = ou=Groups,dc=brain2,dc=com
ldap_group_object_class = group
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true
# sudo settings
sudo_provider = ldap
ldap_sudo_search_base = ou=sudoers,dc=brain2,dc=com
# autofs settings
autofs_provider = ldap
ldap_autofs_search_base=ou=automount,dc=brain2,dc=com
ldap_autofs_map_object_class=nisMap
ldap_autofs_entry_object_class=nisObject
ldap_autofs_map_name=nisMapName
ldap_autofs_entry_key=cn
ldap_autofs_entry_value=nisMapEntry
# shell settings
allowed_shells = /bin/sh,/bin/bash,/bin/zsh,/bin/fish,/bin/ksh,
vetoed_shells = /bin/csh,/bin/tcsh
shell_fallback = /bin/bash
# kerberos settings
# Probably required with sssd 1.8.x and newer
krb5_canonicalize = false
krb5_renewable_lifetime = 1d
krb5_renew_interval = 60s
krb5_lifetime = 1h #normally set by KDC
Kerberos tickets and logs of today:
[root@hostname ~] klist -f /var/lib/sss/db/ccache_example.com
Ticket cache: FILE:/var/lib/sss/db/ccache_example.com
Default principal: hostname$(a)example.com
Valid starting Expires Service principal
11/30/15 13:16:40 11/30/15 23:16:44 krbtgt/example.com(a)example.com
renew until 12/07/15 13:16:40, Flags: RIA
11/30/15 13:16:44 11/30/15 23:16:44 ldap/dc02.example.com@
renew until 12/07/15 13:16:40, Flags: RAO
11/30/15 13:16:44 11/30/15 23:16:44 ldap/dc02.example.com(a)example.com
renew until 12/07/15 13:16:40, Flags: RAO
11/30/15 13:16:44 11/30/15 23:16:44 DNS/dc01.example.com(a)example.com
renew until 12/07/15 13:16:40, Flags: RAO
[root@hostname ~] grep renew /var/log/sssd/sssd_example.com.log
(Mon Nov 30 08:28:49 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Mon Nov 30 09:55:42 2015) [sssd[be[example.com]]] [renew_tgt_done]
(0x0100): Successfully renewed TGT for user [John Doe].
(Mon Nov 30 10:26:42 2015) [sssd[be[example.com]]] [renew_tgt_done]
(0x0100): Successfully renewed TGT for user [John Doe].
(Mon Nov 30 11:36:44 2015) [sssd[be[example.com]]] [renew_tgt_done]
(0x0020): krb5_auth request failed.
(Mon Nov 30 11:36:44 2015) [sssd[be[example.com]]] [renew_tgt_done]
(0x0200): Giving back pam data.
(Mon Nov 30 11:36:44 2015) [sssd[be[example.com]]] [renew_tgt_done]
(0x0020): krb5_auth request failed.
(Mon Nov 30 11:36:44 2015) [sssd[be[example.com]]] [renew_tgt_done]
(0x0200): Giving back pam data.
(Mon Nov 30 11:38:07 2015) [sssd[be[example.com]]] [renew_tgt_done]
(0x0020): krb5_auth request failed.
(Mon Nov 30 11:38:07 2015) [sssd[be[example.com]]] [renew_tgt_done]
(0x0200): Giving back pam data.
(Mon Nov 30 11:38:13 2015) [sssd[be[example.com]]] [renew_tgt_done]
(0x0020): krb5_auth request failed.
(Mon Nov 30 11:38:13 2015) [sssd[be[example.com]]] [renew_tgt_done]
(0x0200): Giving back pam data.
(Mon Nov 30 11:47:35 2015) [sssd[be[example.com]]] [renew_tgt_done]
(0x0020): Failed to renew TGT for user [John Doe].
(Mon Nov 30 11:47:35 2015) [sssd[be[example.com]]] [renew_tgt_done]
(0x0020): Failed to renew TGT for user [Lucy Doe].
(Mon Nov 30 14:16:07 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Mon Nov 30 17:19:34 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Mon Nov 30 18:20:26 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Mon Nov 30 18:21:36 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Mon Nov 30 19:11:06 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Mon Nov 30 19:26:31 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Mon Nov 30 23:30:05 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Tue Dec 1 00:16:56 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Tue Dec 1 01:18:39 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Tue Dec 1 01:32:16 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Tue Dec 1 03:22:02 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Tue Dec 1 04:34:30 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Tue Dec 1 06:27:39 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Tue Dec 1 06:38:20 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Tue Dec 1 07:34:20 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Tue Dec 1 07:56:02 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Tue Dec 1 08:33:09 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
(Tue Dec 1 10:40:41 2015) [sssd[be[example.com]]] [renew_handler]
(0x0100): Offline, disable renew timer.
To be clear, it all works fine up to the point where the TGT ticket expires.
Kind Regards,
Andy