<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="#0563C1" vlink="#954F72"> <div class="WordSection1"> Greetings,<o:p></o:p> <o:p> </o:p> My first post to the forum.<o:p></o:p> <o:p> </o:p> We are running centos7 with freeipa. Syncing from AD, with one linux replica.<o:p></o:p> The ipa clients are getting installed by puppet. All the clients are performing fine, except one. I am getting slow ssh logins to one host, as well as slow ‘id’ and ‘who’, etc. <o:p></o:p> <o:p> </o:p> I turned up the sss-debuglevel to 6, and compared the slow client to another, and I am seeing a section in the logs that is unique to the slow system, basically its doing a SSS_PAM_ACCT_MGMT, and I don’t have any clue why. Same user logging in to both clients, one client does the SSS_PAM_ACCT_MGMT, followed by the SSS_PAM_OPEN_SESSION. While the other client only does SSS_PAM_OPEN_SESSION, and is much faster. (1 second vs 2-8 seconds)<o:p></o:p> It seems the SSS_PAM_ACCT_MGMT is the slow culprit, and I don’t know why its running.<o:p></o:p> <o:p> </o:p> Any idea what would cause this or where I should look?<o:p></o:p> <o:p> </o:p> Below are the log for a good fast client, followed by the log from the slow client.<o:p></o:p> <o:p> </o:p> Thanks!!<o:p></o:p> <o:p> </o:p> Good Client<o:p></o:p> [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][1][name=nobody@ipa.mydomain.org]<o:p></o:p> [sysdb_get_real_name] (0x0040): Cannot find user [nobody@ipa.mydomain.org] in cache<o:p></o:p> [ipa_id_get_account_info_orig_done] (0x0080): Object not found, ending request<o:p></o:p> [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][1][name=myusername@ipa.mydomain.org]<o:p></o:p> [sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such object](32)[ldb_wait: No such object (32)]<o:p></o:p> [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=myusername@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb<o:p></o:p> [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][1][name=myusername@ipa.mydomain.org]<o:p></o:p> [sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such object](32)[ldb_wait: No such object (32)]<o:p></o:p> [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=myusername@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb<o:p></o:p> [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][1][name=myusername@ipa.mydomain.org]<o:p></o:p> [sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such object](32)[ldb_wait: No such object (32)]<o:p></o:p> [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=myusername@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb<o:p></o:p> [sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such object](32)[ldb_wait: No such object (32)]<o:p></o:p> [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=myusername@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb<o:p></o:p> [dp_pam_handler] (0x0100): Got request with the following data<o:p></o:p> [pam_print_data] (0x0100): command: SSS_PAM_OPEN_SESSION<o:p></o:p> [pam_print_data] (0x0100): domain: ipa.mydomain.org<o:p></o:p> [pam_print_data] (0x0100): user: myusername@ipa.mydomain.org<o:p></o:p> [pam_print_data] (0x0100): service: sshd<o:p></o:p> [pam_print_data] (0x0100): tty: ssh<o:p></o:p> [pam_print_data] (0x0100): ruser: <o:p></o:p> [pam_print_data] (0x0100): rhost: myhost.mydomain.org<o:p></o:p> [pam_print_data] (0x0100): authtok type: 0<o:p></o:p> [pam_print_data] (0x0100): newauthtok type: 0<o:p></o:p> [pam_print_data] (0x0100): priv: 1<o:p></o:p> [pam_print_data] (0x0100): cli_pid: 26697<o:p></o:p> [pam_print_data] (0x0100): logon name: not set<o:p></o:p> <o:p> </o:p> <o:p> </o:p> Bad Client<o:p></o:p> [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][1][name=nobody@ipa.mydomain.org]<o:p></o:p> [sysdb_get_real_name] (0x0040): Cannot find user [nobody@ipa.mydomain.org] in cache<o:p></o:p> [ipa_id_get_account_info_orig_done] (0x0080): Object not found, ending request<o:p></o:p> [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][1][name=myusername@ipa.mydomain.org]<o:p></o:p> [sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such object](32)[ldb_wait: No such object (32)]<o:p></o:p> [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=myusername@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb<o:p></o:p> [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][1][name=myusername@ipa.mydomain.org]<o:p></o:p> [sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such object](32)[ldb_wait: No such object (32)]<o:p></o:p> [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=myusername@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb<o:p></o:p> [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][1][name=myusername@ipa.mydomain.org]<o:p></o:p> [sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such object](32)[ldb_wait: No such object (32)]<o:p></o:p> [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=myusername@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb<o:p></o:p> [sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such object](32)[ldb_wait: No such object (32)]<o:p></o:p> [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=myusername@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb<o:p></o:p> [dp_pam_handler] (0x0100): Got request with the following data<o:p></o:p> [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT<o:p></o:p> [pam_print_data] (0x0100): domain: ipa.mydomain.org<o:p></o:p> [pam_print_data] (0x0100): user: myusername@ipa.mydomain.org<o:p></o:p> [pam_print_data] (0x0100): service: sshd<o:p></o:p> [pam_print_data] (0x0100): tty: ssh<o:p></o:p> [pam_print_data] (0x0100): ruser: <o:p></o:p> [pam_print_data] (0x0100): rhost: myhost@mydomain.org<o:p></o:p> [pam_print_data] (0x0100): authtok type: 0<o:p></o:p> [pam_print_data] (0x0100): newauthtok type: 0<o:p></o:p> [pam_print_data] (0x0100): priv: 1<o:p></o:p> [pam_print_data] (0x0100): cli_pid: 183633<o:p></o:p> [pam_print_data] (0x0100): logon name: not set<o:p></o:p> [ipa_hostgroup_info_done] (0x0200): Dereferenced host group: darkjedi<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [sysdb_delete_entry] (0x0080): sysdb_delete_ts_entry failed: 0<o:p></o:p> [hbac_get_category] (0x0200): Category is set to 'all'.<o:p></o:p> [get_ipa_groupname] (0x0020): Expected cn in RDN, got uid<o:p></o:p> [hbac_user_attrs_to_rule] (0x0020): [uid=slurm,cn=users,cn=accounts,dc=ipa,dc=mydomain,dc=org] does not map to either a user or group. Skipping<o:p></o:p> [hbac_get_category] (0x0200): Category is set to 'all'.<o:p></o:p> [hbac_get_category] (0x0200): Category is set to 'all'.<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got privileges<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got privileges<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected groups second component, got permissions<o:p></o:p> [get_ipa_groupname] (0x0020): Expected cn in RDN, got ipaUniqueID<o:p></o:p> [get_ipa_groupname] (0x0020): Expected cn in RDN, got ipaUniqueID<o:p></o:p> [hbac_evaluate] (0x0100): [< hbac_evaluate()<o:p></o:p> [hbac_evaluate] (0x0100): The rule [darkjedi-access] did not match.<o:p></o:p> [hbac_evaluate] (0x0100): ALLOWED by rule [Infrastructure].<o:p></o:p> [hbac_evaluate] (0x0100): hbac_evaluate() >]<o:p></o:p> [ipa_hbac_evaluate_rules] (0x0080): Access granted by HBAC rule [Infrastructure]<o:p></o:p> [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][1][name=myusername@ipa.mydomain.org]<o:p></o:p> [sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such object](32)[ldb_wait: No such object (32)]<o:p></o:p> [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=myusername@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb<o:p></o:p> [sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such object](32)[ldb_wait: No such object (32)]<o:p></o:p> [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=myusername@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb<o:p></o:p> [dp_pam_handler] (0x0100): Got request with the following data<o:p></o:p> [pam_print_data] (0x0100): command: SSS_PAM_OPEN_SESSION<o:p></o:p> [pam_print_data] (0x0100): domain: ipa.mydomain.org<o:p></o:p> [pam_print_data] (0x0100): user: myusername@ipa.mydomain.org<o:p></o:p> [pam_print_data] (0x0100): service: sshd<o:p></o:p> [pam_print_data] (0x0100): tty: ssh<o:p></o:p> [pam_print_data] (0x0100): ruser: <o:p></o:p> [pam_print_data] (0x0100): rhost: myhost@mydomain.org<o:p></o:p> [pam_print_data] (0x0100): authtok type: 0<o:p></o:p> [pam_print_data] (0x0100): newauthtok type: 0<o:p></o:p> [pam_print_data] (0x0100): priv: 1<o:p></o:p> [pam_print_data] (0x0100): cli_pid: 183633<o:p></o:p> [pam_print_data] (0x0100): logon name: not set<o:p></o:p> [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][1][name=myusername@ipa.mydomain.org]<o:p></o:p> [sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such object](32)[ldb_wait: No such object (32)]<o:p></o:p> [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=myusername@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb<o:p></o:p> [sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such object](32)[ldb_wait: No such object (32)]<o:p></o:p> [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=myusername@ipa.mydomain.org,cn=users,cn=ipa.mydomain.org,cn=sysdb<o:p></o:p> [dp_get_account_info_handler] (0x0200): Got request for [0x2][BE_REQ_GROUP][1][idnumber=1051800710]<o:p></o:p> [sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such object](32)[ldb_wait: No such object (32)]<o:p></o:p> [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=myusername@ipa.mydomain.org,cn=groups,cn=ipa.mydomain.org,cn=sysdb<o:p></o:p> [sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [No such object](32)[ldb_wait: No such object (32)]<o:p></o:p> [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=myusername@ipa.mydomain.org,cn=groups,cn=ipa.mydomain.org,cn=sysdb<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <o:p> </o:p> <o:p> </o:p> <table class="MsoTableGrid" border="0" cellspacing="0" cellpadding="0" style="margin-left:5.4pt;border-collapse:collapse;border:none"> <tbody> <tr> <td width="139" valign="bottom" style="width:104.0pt;padding:0in 5.4pt 0in 5.4pt"> <a href="http://www.swri.org/"><img border="0" width="96" height="56" id="Picture_x0020_25" src="cid:image002.png@01D29E69.6E7C99E0"></a><o:p></o:p> </td> <td width="485" valign="bottom" style="width:364.0pt;padding:0in 5.4pt 0in 5.4pt"> Jim Kilborn, Principal Technical Specialist<o:p></o:p> Information Technology, Division 18<o:p></o:p> Southwest Research Institute<o:p></o:p> Office (210) 522-2739 jim.kilborn@swri.org<o:p></o:p> </td> </tr> </tbody> </table> <![if !vml]><img width="605" height="2" src="cid:image003.png@01D29E69.6E7C99E0" v:shapes="Straight_x0020_Connector_x0020_6"><![endif]><o:p></o:p> <table class="MsoTableGrid" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none"> <tbody> <tr> <td width="144" style="width:1.5in;padding:0in 5.4pt 0in 5.4pt"> <a href="https://www.linkedin.com/company/southwest-research-institute"><img border="0" width="24" height="24" id="Picture_x0020_21" src="cid:image004.png@01D29D66.A9B19BE0"></a> <a href="https://www.facebook.com/southwestresearch"><img border="0" width="24" height="24" id="Picture_x0020_22" src="cid:image005.png@01D29D66.A9B19BE0"></a> <a href="https://www.youtube.com/user/SwRItv"><img border="0" width="24" height="24" id="Picture_x0020_23" src="cid:image006.png@01D29D66.A9B19BE0"></a> <a href="https://twitter.com/swri"><img border="0" width="24" height="24" id="Picture_x0020_24" src="cid:image007.png@01D29D66.A9B19BE0"></a><o:p></o:p> </td> <td width="259" style="width:2.7in;padding:0in 5.4pt 0in 5.4pt"> Advanced science. Applied technology.<o:p></o:p> </td> </tr> </tbody> </table> <o:p> </o:p> <o:p> </o:p> <o:p> </o:p> </div> </body> </html>