<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1468701547024_23328"><span id="yui_3_16_0_1_1468701547024_23541">Sumit,</span></div><div id="yui_3_16_0_1_1468701547024_23328"><span><br></span></div><div id="yui_3_16_0_1_1468701547024_23328" dir="ltr"><span id="yui_3_16_0_1_1468701547024_23394">I have set the names of all the Domain Controllers to be resolvable to the IP of the one reachable Domain Controller in /etc/hosts</span></div><div id="yui_3_16_0_1_1468701547024_23328"><br></div><div id="yui_3_16_0_1_1468701547024_23328">/etc/hosts:</div><div id="yui_3_16_0_1_1468701547024_23328">Reachable_IP_BOX 172.10.10.1</div><div id="yui_3_16_0_1_1468701547024_23328">DC1 172.10.10.1</div><div id="yui_3_16_0_1_1468701547024_23328">DC2 172.10.10.1</div><div id="yui_3_16_0_1_1468701547024_23328">...</div><div id="yui_3_16_0_1_1468701547024_23328">...</div><div id="yui_3_16_0_1_1468701547024_23328"><br></div><div id="yui_3_16_0_1_1468701547024_23328">However, I still see the following</div><div id="yui_3_16_0_1_1468701547024_23680"><i id="yui_3_16_0_1_1468701547024_24473">Marking SRV lookup of service 'gc_addomain.local' as 'neutral'<br></i></div><div id="yui_3_16_0_1_1468701547024_23683"><i id="yui_3_16_0_1_1468701547024_24402">Marking server dc1.addomain.local' as 'name not resolved'</i></div><div id="yui_3_16_0_1_1468701547024_23684"><br></div><div id="yui_3_16_0_1_1468701547024_23684"><br></div><div id="yui_3_16_0_1_1468701547024_23684">Additionally I have configured </div><div id="yui_3_16_0_1_1468701547024_23684" dir="ltr"><b id="yui_3_16_0_1_1468701547024_24522">[domain/ipa.internal]</b><br></div><div dir="ltr" id="yui_3_16_0_1_1468701547024_23940"> with <br></div><div dir="ltr" id="yui_3_16_0_1_1468701547024_23941"><i id="yui_3_16_0_1_1468701547024_23952"><b id="yui_3_16_0_1_1468701547024_24609">subdomain_inherit = ldap_user_principal</b></i></div><div dir="ltr" id="yui_3_16_0_1_1468701547024_23942"><i id="yui_3_16_0_1_1468701547024_23951"><b id="yui_3_16_0_1_1468701547024_24910">ldap_user_principal = nosuchattr</b></i></div><div dir="ltr" id="yui_3_16_0_1_1468701547024_23943"><br><br>As far as your earlier note about seeing <b id="yui_3_16_0_1_1468701547024_24608">ewr-fipa-x1</b> in logs. That used to be the old hostname of the IPA KDC.</div><div dir="ltr" id="yui_3_16_0_1_1468701547024_23943">After much troubleshooting I believe I got this fixed by deleting extra folders in<br>/var/named/dyndb-ldap/ipa/master</div><div dir="ltr" id="yui_3_16_0_1_1468701547024_23943">Right now the only two folders are <b id="yui_3_16_0_1_1468701547024_24607">ipa.internal</b> and <b id="yui_3_16_0_1_1468701547024_24708"><ip.adddr>.in-addr.arpa.</b><br>I <i id="yui_3_16_0_1_1468701547024_24363"><u>think </u></i>this is what helped with this issue. but can you please confirm if it sounds reasonable.</div><div dir="ltr" id="yui_3_16_0_1_1468701547024_23685"><br id="yui_3_16_0_1_1468701547024_23686"></div><div id="yui_3_16_0_1_1468701547024_23328"><br></div><div class="qtdSeparateBR" id="yui_3_16_0_1_1468701547024_23329">Ssh is still failing, possibly due to the problem 1 above. Is there anything else I can do to force ipa to pay attention to the /etc/hosts ?</div><div class="qtdSeparateBR" id="yui_3_16_0_1_1468701547024_23329">Or is this some other issue?</div><div class="qtdSeparateBR" id="yui_3_16_0_1_1468701547024_23329"><br></div><div class="qtdSeparateBR" id="yui_3_16_0_1_1468701547024_23329">thanks</div><div class="yahoo_quoted" id="yui_3_16_0_1_1468701547024_23531" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_1_1468701547024_23530"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_1_1468701547024_23529"> <div dir="ltr" id="yui_3_16_0_1_1468701547024_23528"> <font size="2" face="Arial" id="yui_3_16_0_1_1468701547024_23544"> <hr size="1" id="yui_3_16_0_1_1468701547024_23543"> <b><span style="font-weight:bold;">From:</span></b> Sumit Bose <sbose@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> pgb205 <pgb205@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> Sumit Bose <sbose@redhat.com>; Freeipa-users <freeipa-users@redhat.com><br> <b><span style="font-weight: bold;">Sent:</span></b> Wednesday, July 13, 2016 5:43 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] Unable to ssh after establishing trust<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_1_1468701547024_23612"><br>On Tue, Jul 12, 2016 at 06:40:22PM +0000, pgb205 wrote:<br clear="none">> +freeipa-users list<br clear="none">> <br clear="none">> From: pgb205 <<a shape="rect" ymailto="mailto:pgb205@yahoo.com" href="mailto:pgb205@yahoo.com">pgb205@yahoo.com</a>><br clear="none">> To: Sumit Bose <<a shape="rect" ymailto="mailto:sbose@redhat.com" href="mailto:sbose@redhat.com">sbose@redhat.com</a>> <br clear="none">> Sent: Tuesday, July 12, 2016 2:12 PM<br clear="none">> Subject: Re: [Freeipa-users] Unable to ssh after establishing trust<br clear="none">> <br clear="none">> Sumit, thanks for replying<br clear="none">> So the first issue is my fault, probably from when I was sanitizing logs. <br clear="none">> our active directory domain is ad_domain.local, but users would expect to login as <a shape="rect" ymailto="mailto:userid@ad_domain.com" href="mailto:userid@ad_domain.com">userid@ad_domain.com</a> or just userid.for ipa the kerberos realm is IPA_DOMAIN.INTERNAL and domain is ipa_domain.internal.<br clear="none">> ewr-fipa_server used to be old trial server so I am not sure why it's still in the dns lookup results. I'll check this part further.<br clear="none">> Lastly. only the connection to one of the domain controllers on AD side is open. As discussed previously with Alexandr BokovoyI forced, in /etc/krb5.conf, a connection to this single, accessible domain controller. Are there any other files where I would needto lock down the connections between ipa->ad so that all traffic goes to specific active directory domain controller?<br clear="none">> thanks again for replying so quickly.<br clear="none"><br clear="none">Currently it is not possible to specify individual AD DC SSSD on the IPA<br clear="none">server should talk to. We have ticket<br clear="none"><a shape="rect" href="https://fedorahosted.org/sssd/ticket/2599" target="_blank">https://fedorahosted.org/sssd/ticket/2599 </a>to make this possible in some<br clear="none">later versions of SSSD. <br clear="none"><br clear="none">Currently SSSD uses a DNS SRV lookup like _ldap._tcp.ad_domain.local to<br clear="none">get a list of AD DC, then picks one to get the next nearest site for the<br clear="none">IPA domain and finally tries to lookup a DC from the matching site (if<br clear="none">any).<br clear="none"><br clear="none">According to your logs SSSD was able to find 18 DCs with the SRV lookup.<br clear="none">A call like<br clear="none"><br clear="none"> dig SRV _ldap._tcp.ad_domain.local<br clear="none"><br clear="none">on the IPA server should return the same list of 18 DCs.<br clear="none"><br clear="none">As a work-around, or better a hack, you might want to try to set the IP<br clear="none">address of all the 18 DC returned to the IP address of the only<br clear="none">accessible DC in /etc/hosts. This way SSSD should have no chance to<br clear="none">connect to a different DC.<br clear="none"><br clear="none">bye,<div class="yqt7418844234" id="yqtfd70541"><br clear="none">Sumit<br clear="none"><br clear="none">> <br clear="none">> From: Sumit Bose <<a shape="rect" ymailto="mailto:sbose@redhat.com" href="mailto:sbose@redhat.com">sbose@redhat.com</a>><br clear="none">> To: pgb205 <<a shape="rect" ymailto="mailto:pgb205@yahoo.com" href="mailto:pgb205@yahoo.com">pgb205@yahoo.com</a>> <br clear="none">> Cc: Sumit Bose <<a shape="rect" ymailto="mailto:sbose@redhat.com" href="mailto:sbose@redhat.com">sbose@redhat.com</a>><br clear="none">> Sent: Tuesday, July 12, 2016 5:37 AM<br clear="none">> Subject: Re: [Freeipa-users] Unable to ssh after establishing trust<br clear="none">> <br clear="none">> On Mon, Jul 11, 2016 at 09:14:03PM +0000, pgb205 wrote:<br clear="none">> > Sumit, <br clear="none">> > sssd log files attached with debug=10 in all sections.I have attempted several logins for comparison as well as kinit commands<br clear="none">> <br clear="none">> I came across two issues in the logs.<br clear="none">> <br clear="none">> First it looks like you use '<a shape="rect" ymailto="mailto:user@AD_DOMAIN.LOCAL" href="mailto:user@AD_DOMAIN.LOCAL">user@AD_DOMAIN.LOCAL</a>' at the login prompt<br clear="none">> but there seem to be an alternative domain suffix 'AD_DOMAIN.COM' on the<br clear="none">> AD side and user principal attributes '<a shape="rect" ymailto="mailto:user@AD_DOMAIN.COM" href="mailto:user@AD_DOMAIN.COM">user@AD_DOMAIN.COM</a>'. Currently<br clear="none">> FreeIPA cannot resolve those principals correctly. It was planned for<br clear="none">> IPA 4.4.0 and SSSD 1.14.0 but because of an issue found in 4.4.0 it will<br clear="none">> be available (hopefully) with IPA 4.4.1 and SSSD 1.14.1. In the meantime<br clear="none">> please try to work-around suggested at the end of<br clear="none">> <a shape="rect" href="http://osdir.com/ml/freeipa-users/2016-01/msg00304.html" target="_blank">http://osdir.com/ml/freeipa-users/2016-01/msg00304.html </a>. When trying to<br clear="none">> authenticate with <a shape="rect" ymailto="mailto:user@AD_DOMAIN.COM" href="mailto:user@AD_DOMAIN.COM">user@AD_DOMAIN.COM</a> SSSD looks for a server called<br clear="none">> ewr-fipa_server.ad_domain.com but cannot find it an return the error code<br clear="none">> for "Cannot contact any KDC for requested realm".<br clear="none">> <br clear="none">> Second there are some issues access AD DCs via LDAP. SSSD tries to<br clear="none">> connect to mm-sfdc01.ad_domain.local and mm-tokyo-02.ad_domain.local but<br clear="none">> both fails. It is not clear from the logs if already the DNS lookup for<br clear="none">> those fails or if the connection itself runs into a timeout. In the<br clear="none">> former case you should make sure that the names can be resolved in the<br clear="none">> IPA server in the latter you can try to increase ldap_network_timeout<br clear="none">> (see man sssd-ldap for details). Since SSSD cannot connect to the DCs it<br clear="none">> switches the AD domains to offline. The authentication request is<br clear="none">> handled offline as well but since there are no cached credentials you<br clear="none">> get the permission denied error.<br clear="none">> <br clear="none">> HTH<br clear="none">> <br clear="none">> bye,<br clear="none">> Sumit<br clear="none">> <br clear="none">> > <br clear="none">> > From: Sumit Bose <<a shape="rect" ymailto="mailto:sbose@redhat.com" href="mailto:sbose@redhat.com">sbose@redhat.com</a>><br clear="none">> > To: pgb205 <<a shape="rect" ymailto="mailto:pgb205@yahoo.com" href="mailto:pgb205@yahoo.com">pgb205@yahoo.com</a>> <br clear="none">> > Cc: "<a shape="rect" ymailto="mailto:Freeipa-users@redhat.com" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>" <<a shape="rect" ymailto="mailto:Freeipa-users@redhat.com" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>><br clear="none">> > Sent: Monday, July 11, 2016 3:06 AM<br clear="none">> > Subject: Re: [Freeipa-users] Unable to ssh after establishing trust<br clear="none">> > <br clear="none">> > On Mon, Jul 11, 2016 at 03:46:57AM +0000, pgb205 wrote:<br clear="none">> > > I have successfully established trust and am able to obtain ticket granting ticketkinit <a shape="rect" ymailto="mailto:user@AD_DOMAIN.COMI" href="mailto:user@AD_DOMAIN.COMI">user@AD_DOMAIN.COMI</a> can also do kinit <a shape="rect" ymailto="mailto:admin@IPA_DOMAIN.COMssh" href="mailto:admin@IPA_DOMAIN.COMssh">admin@IPA_DOMAIN.COMssh</a> <a shape="rect" ymailto="mailto:admin@IPA_DOMAIN.COM" href="mailto:admin@IPA_DOMAIN.COM">admin@IPA_DOMAIN.COM</a> also works<br clear="none">> > > however, ssh <a shape="rect" ymailto="mailto:user@AD_DOMAIN.COM" href="mailto:user@AD_DOMAIN.COM">user@AD_DOMAIN.COM</a> or <a shape="rect" ymailto="mailto:user@ad_domain.com" href="mailto:user@ad_domain.com">user@ad_domain.com</a> fails<br clear="none">> > > I have checked that there are no hbac rules other then the default allow_all rule<br clear="none">> > > in sssd_ssh.log see<br clear="none">> > > permission denied (6) error in sssd_ipa.domain.log file I see<br clear="none">> > > pam_handler_callback 6 permission_denied<br clear="none">> > > in sssd_nss.log Unable to get information from Data ProviderError: 3 Account info lookup failedWill try to return what we have in cache<br clear="none">> > > in /var/log/secure received for user <a shape="rect" ymailto="mailto:user@AD_DOMAIN.COM" href="mailto:user@AD_DOMAIN.COM">user@AD_DOMAIN.COM</a>: 6 (Permission denied) <br clear="none">> > > <br clear="none">> > > I can provided full logs if necessary to diagnose the above problem.<br clear="none">> > <br clear="none">> > Yes, full SSSD logs with debug_level=10 would be best.<br clear="none">> > <br clear="none">> > > ----------Additionally, I would like to be able to login as user not <a shape="rect" ymailto="mailto:user@AD_DOMAIN.COM" href="mailto:user@AD_DOMAIN.COM">user@AD_DOMAIN.COM</a><br clear="none">> > > My understanding that only thing that I have to change to make this happen is /etc/krb5.conffor line <br clear="none">> > > [libdefaults] default_realm=AD_DOMAN.COM and then restarting ipa services.<br clear="none">> > <br clear="none">> > No, please do not change the default_realm. This is not related to the<br clear="none">> > issues you are seeing.<br clear="none">> > <br clear="none">> > bye,<br clear="none">> > Sumit<br clear="none">> > <br clear="none">> > > However, when I do this I get failure to restart Samba service<br clear="none">> > <br clear="none">> > > -- <br clear="none">> > > Manage your subscription for the Freeipa-users mailing list:<br clear="none">> > > <a shape="rect" href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br clear="none">> > > Go to <a shape="rect" href="http://freeipa.org/" target="_blank">http://freeipa.org </a>for more info on the project<br clear="none">> > <br clear="none">> > <br clear="none">> > <br clear="none">> > <br clear="none">> <br clear="none">> <br clear="none">> <br clear="none">> <br clear="none">> <br clear="none">> <br clear="none">> <br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>