<div dir="ltr">Hi,<br><br><div><br></div><div>I removed the <span style="font-size:12.8px">pam_winbind module. User are able to login now. But some time they are not. Below are logs when user are not able to login. Also SSH login is very slow for AD user. I am using sssd 1.4</span></div><div><span style="font-size:12.8px">=============================</span></div><div><div><span style="font-size:12.8px">rpm -qa | grep sssd</span></div><div><span style="font-size:12.8px">sssd-krb5-common-1.14.0-43.el7.x86_64</span></div><div><span style="font-size:12.8px">python-sssdconfig-1.14.0-43.el7.noarch</span></div><div><span style="font-size:12.8px">sssd-ldap-1.14.0-43.el7.x86_64</span></div><div><span style="font-size:12.8px">sssd-client-1.14.0-43.el7.x86_64</span></div><div><span style="font-size:12.8px">sssd-ipa-1.14.0-43.el7.x86_64</span></div><div><span style="font-size:12.8px">sssd-proxy-1.14.0-43.el7.x86_64</span></div><div><span style="font-size:12.8px">sssd-common-1.14.0-43.el7.x86_64</span></div><div><span style="font-size:12.8px">sssd-ad-1.14.0-43.el7.x86_64</span></div><div><span style="font-size:12.8px">sssd-1.14.0-43.el7.x86_64</span></div><div><span style="font-size:12.8px">sssd-krb5-1.14.0-43.el7.x86_64</span></div><div><span style="font-size:12.8px">sssd-common-pac-1.14.0-43.el7.x86_64</span></div></div><div><span style="font-size:12.8px">===========================<br><br>=====================================<br>My s</span><span style="font-size:12.8px">ssd.conf on ipa clinet</span></div><div><span style="font-size:12.8px"><br></span></div><div><div><span style="font-size:12.8px">cat /etc/sssd/sssd.conf</span></div><div><span style="font-size:12.8px">[domain/ipa.preprod.local]</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">cache_credentials = True</span></div><div><span style="font-size:12.8px">krb5_store_password_if_offline = True</span></div><div><span style="font-size:12.8px">ipa_domain = ipa.ipadomain.local</span></div><div><span style="font-size:12.8px">id_provider = ipa</span></div><div><span style="font-size:12.8px">auth_provider = ipa</span></div><div><span style="font-size:12.8px">access_provider = ipa</span></div><div><span style="font-size:12.8px">ipa_hostname = ilt-gif-ipa02.ipa.ipadomain.local</span></div><div><span style="font-size:12.8px">chpass_provider = ipa</span></div><div><span style="font-size:12.8px">ipa_server = _srv_, ilt-gif-ipa01.ipa.ipadomain.local</span></div><div><span style="font-size:12.8px">ldap_tls_cacert = /etc/ipa/ca.crt</span></div><div><span style="font-size:12.8px">debug_level = 10</span></div><div><span style="font-size:12.8px">krb5_use_enterprise_principal = True</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">[sssd]</span></div><div><span style="font-size:12.8px">default_domain_suffix = <a href="http://corp.addomain.com">corp.addomain.com</a></span></div><div><span style="font-size:12.8px">services = nss, sudo, pam, ssh</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">domains = ipa.ipadomain.local</span></div><div><span style="font-size:12.8px">debug_level = 10</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">[nss]</span></div><div><span style="font-size:12.8px">override_homedir = /home/%u</span></div><div><span style="font-size:12.8px">debug_level = 10</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">[pam]</span></div><div><span style="font-size:12.8px">debug_level = 10</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">[sudo]</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">[autofs]</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">[ssh]</span></div><div><span style="font-size:12.8px">debug_level = 10</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">[pac]</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">[ifp]</span></div><div style="font-size:12.8px">==============================================</div></div><div><br></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">/var/log/sssd/krb5_child.log</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [main] (0x0400): krb5_child started.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [unpack_buffer] (0x1000): total buffer size: [63]</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [unpack_buffer] (0x0100): cmd [249] uid [1007629326] gid [1007629326] validate [true] enterprise principal [false] offline [true] UPN [<a href="mailto:Subaranchan.T@MYDOMAON.COM">Subaranchan.T@MYDOMAON.COM</a>]</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [become_user] (0x0200): Trying to become user [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [main] (0x2000): Running as [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [become_user] (0x0200): Trying to become user [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [become_user] (0x0200): Already user [1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [k5c_setup] (0x2000): Running as [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [main] (0x0400): Will perform pre-auth</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [tgt_req_child] (0x1000): Attempting to get a TGT</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [<a href="http://MYDOMAON.COM">MYDOMAON.COM</a>]</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [sss_child_krb5_trace_cb] (0x4000): [16083] 1479465985.794345: Getting initial credentials for <a href="mailto:Subaranchan.T@MYDOMAON.COM">Subaranchan.T@MYDOMAON.COM</a></span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [sss_child_krb5_trace_cb] (0x4000): [16083] 1479465985.796449: Sending request (176 bytes) to <a href="http://MYDOMAON.COM">MYDOMAON.COM</a></span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [sss_child_krb5_trace_cb] (0x4000): [16083] 1479465985.797433: Retrying AS request with master KDC</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [sss_child_krb5_trace_cb] (0x4000): [16083] 1479465985.797466: Getting initial credentials for <a href="mailto:Subaranchan.T@MYDOMAON.COM">Subaranchan.T@MYDOMAON.COM</a></span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [sss_child_krb5_trace_cb] (0x4000): [16083] 1479465985.797508: Sending request (176 bytes) to <a href="http://MYDOMAON.COM">MYDOMAON.COM</a> (master)</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [get_and_save_tgt] (0x0400): krb5_get_init_creds_password returned [-1765328230} during pre-auth.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [k5c_send_data] (0x0200): Received error code 0</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [pack_response_packet] (0x2000): response packet size: [4]</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [k5c_send_data] (0x4000): Response sent.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16083]]]] [main] (0x0400): krb5_child completed successfully</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [main] (0x0400): krb5_child started.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [unpack_buffer] (0x1000): total buffer size: [168]</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [unpack_buffer] (0x0100): cmd [241] uid [1007629326] gid [1007629326] validate [true] enterprise principal [false] offline [true] UPN [<a href="mailto:Subaranchan.T@MYDOMAON.COM">Subaranchan.T@MYDOMAON.COM</a>]</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [unpack_buffer] (0x0100): ccname: [KEYRING:persistent:1007629326] old_ccname: [KEYRING:persistent:1007629326] keytab: [/etc/krb5.keytab]</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [switch_creds] (0x0200): Switch user to [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [switch_creds] (0x0200): Switch user to [0][0].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [k5c_check_old_ccache] (0x4000): Ccache_file is [KEYRING:persistent:1007629326] and is active and TGT is valid.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [become_user] (0x0200): Trying to become user [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [main] (0x2000): Running as [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [become_user] (0x0200): Trying to become user [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [become_user] (0x0200): Already user [1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [k5c_setup] (0x2000): Running as [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [main] (0x0400): Will perform offline auth</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [create_empty_ccache] (0x1000): Existing ccache still valid, reusing</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [k5c_send_data] (0x0200): Received error code 0</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [pack_response_packet] (0x2000): response packet size: [53]</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [k5c_send_data] (0x4000): Response sent.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:25 2016) [[sssd[krb5_child[16084]]]] [main] (0x0400): krb5_child completed successfully</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [main] (0x0400): krb5_child started.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [unpack_buffer] (0x1000): total buffer size: [63]</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [unpack_buffer] (0x0100): cmd [249] uid [1007629326] gid [1007629326] validate [true] enterprise principal [false] offline [true] UPN [<a href="mailto:Subaranchan.T@MYDOMAON.COM">Subaranchan.T@MYDOMAON.COM</a>]</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [become_user] (0x0200): Trying to become user [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [main] (0x2000): Running as [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [become_user] (0x0200): Trying to become user [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [become_user] (0x0200): Already user [1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [k5c_setup] (0x2000): Running as [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [main] (0x0400): Will perform pre-auth</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [tgt_req_child] (0x1000): Attempting to get a TGT</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [<a href="http://MYDOMAON.COM">MYDOMAON.COM</a>]</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [sss_child_krb5_trace_cb] (0x4000): [16085] 1479465990.426010: Getting initial credentials for <a href="mailto:Subaranchan.T@MYDOMAON.COM">Subaranchan.T@MYDOMAON.COM</a></span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [sss_child_krb5_trace_cb] (0x4000): [16085] 1479465990.428093: Sending request (176 bytes) to <a href="http://MYDOMAON.COM">MYDOMAON.COM</a></span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [sss_child_krb5_trace_cb] (0x4000): [16085] 1479465990.429220: Retrying AS request with master KDC</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [sss_child_krb5_trace_cb] (0x4000): [16085] 1479465990.429257: Getting initial credentials for <a href="mailto:Subaranchan.T@MYDOMAON.COM">Subaranchan.T@MYDOMAON.COM</a></span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [sss_child_krb5_trace_cb] (0x4000): [16085] 1479465990.429319: Sending request (176 bytes) to <a href="http://MYDOMAON.COM">MYDOMAON.COM</a> (master)</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [get_and_save_tgt] (0x0400): krb5_get_init_creds_password returned [-1765328230} during pre-auth.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [k5c_send_data] (0x0200): Received error code 0</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [pack_response_packet] (0x2000): response packet size: [4]</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [k5c_send_data] (0x4000): Response sent.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16085]]]] [main] (0x0400): krb5_child completed successfully</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [main] (0x0400): krb5_child started.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [unpack_buffer] (0x1000): total buffer size: [168]</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [unpack_buffer] (0x0100): cmd [241] uid [1007629326] gid [1007629326] validate [true] enterprise principal [false] offline [true] UPN [<a href="mailto:Subaranchan.T@MYDOMAON.COM">Subaranchan.T@MYDOMAON.COM</a>]</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [unpack_buffer] (0x0100): ccname: [KEYRING:persistent:1007629326] old_ccname: [KEYRING:persistent:1007629326] keytab: [/etc/krb5.keytab]</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [switch_creds] (0x0200): Switch user to [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [switch_creds] (0x0200): Switch user to [0][0].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [k5c_check_old_ccache] (0x4000): Ccache_file is [KEYRING:persistent:1007629326] and is active and TGT is valid.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [become_user] (0x0200): Trying to become user [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [main] (0x2000): Running as [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [become_user] (0x0200): Trying to become user [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [become_user] (0x0200): Already user [1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [k5c_setup] (0x2000): Running as [1007629326][1007629326].</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [main] (0x0400): Will perform offline auth</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [create_empty_ccache] (0x1000): Existing ccache still valid, reusing</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [k5c_send_data] (0x0200): Received error code 0</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [pack_response_packet] (0x2000): response packet size: [53]</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [k5c_send_data] (0x4000): Response sent.</span></div><div><span style="font-size:12.8px">(Fri Nov 18 11:46:30 2016) [[sssd[krb5_child[16086]]]] [main] (0x0400): krb5_child completed successfully</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">/var/log/secure</span></div><div><span style="font-size:12.8px">Nov 18 11:46:30 ilt-gif-ipa02 sshd[16060]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x user=st1985</span></div><div><span style="font-size:12.8px">Nov 18 11:46:30 ilt-gif-ipa02 sshd[16060]: pam_sss(sshd:auth): received for user st1985: 6 (Permission denied)</span></div><div><span style="font-size:12.8px">Nov 18 11:46:30 ilt-gif-ipa02 sshd[16060]: Failed password for et33015 from x.x.x.x port 58568 ssh2</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div style="font-size:12.8px"><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Nov 16, 2016 at 2:31 PM, rajat gupta <span dir="ltr"><<a href="mailto:rajat.linux@gmail.com" target="_blank">rajat.linux@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Thanks, It is working for few user but not for every one. I have cleared the sssd cache as well.<div>=====================</div><div><div>/var/log/secure<br><br></div><div>Nov 16 14:06:39 ipa-clinet1 sshd[6852]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.213.0.134 user=kb1980</div><div>Nov 16 14:06:39 ipa-clinet1 sshd[6852]: pam_sss(sshd:auth): received for user kb1980: 6 (Permission denied)</div><div>Nov 16 14:06:39 ipa-clinet1 sshd[6852]: pam_winbind(sshd:auth): getting password (0x00000010)</div><div>Nov 16 14:06:39 ipa-clinet1 sshd[6852]: pam_winbind(sshd:auth): pam_get_item returned a password</div><div>Nov 16 14:06:39 ipa-clinet1 sshd[6852]: pam_winbind(sshd:auth): internal module error (retval = PAM_AUTHINFO_UNAVAIL(9), user = 'kb1980')</div><div>Nov 16 14:06:39 ipa-clinet1 sshd[6852]: Failed password for kb1980 from 146.213.0.134 port 51114 ssh2</div><div>Nov 16 14:06:48 ipa-clinet1 sshd[6852]: Connection closed by 146.213.0.134 [preauth]</div><div>Nov 16 14:07:07 ipa-clinet1 sshd[3677]: pam_unix(sshd:session): session closed for user kb1980</div><div><br></div><div>========================</div><div>krb5_child.log<br><br></div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [main] (0x0400): krb5_child started.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [unpack_buffer] (0x1000): total buffer size: [54]</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [unpack_buffer] (0x0100): cmd [249] uid [1007628631] gid [1007628631] validate [true] enterprise principal [false] offline [true] UPN [karan.b@MYDOMAIN COM]</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [become_user] (0x0200): Trying to become user [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [main] (0x2000): Running as [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [become_user] (0x0200): Trying to become user [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [become_user] (0x0200): Already user [1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [k5c_setup] (0x2000): Running as [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [main] (0x0400): Will perform pre-auth</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [tgt_req_child] (0x1000): Attempting to get a TGT</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [MYDOMAIN COM]</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [sss_child_krb5_trace_cb] (0x4000): [6879] 1479301593.872554: Getting initial credentials for karan.b@MYDOMAIN COM</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [sss_child_krb5_trace_cb] (0x4000): [6879] 1479301593.874607: Sending request (167 bytes) to MYDOMAIN COM</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [sss_child_krb5_trace_cb] (0x4000): [6879] 1479301593.898179: Retrying AS request with master KDC</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [sss_child_krb5_trace_cb] (0x4000): [6879] 1479301593.898221: Getting initial credentials for karan.b@MYDOMAIN COM</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [sss_child_krb5_trace_cb] (0x4000): [6879] 1479301593.898291: Sending request (167 bytes) to MYDOMAIN COM (master)</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [get_and_save_tgt] (0x0400): krb5_get_init_creds_password returned [-1765328230} during pre-auth.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [k5c_send_data] (0x0200): Received error code 0</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [pack_response_packet] (0x2000): response packet size: [4]</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [k5c_send_data] (0x4000): Response sent.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [main] (0x0400): krb5_child completed successfully</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [main] (0x0400): krb5_child started.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [unpack_buffer] (0x1000): total buffer size: [159]</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [unpack_buffer] (0x0100): cmd [241] uid [1007628631] gid [1007628631] validate [true] enterprise principal [false] offline [true] UPN [karan.b@MYDOMAIN COM]</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [unpack_buffer] (0x0100): ccname: [KEYRING:persistent:<wbr>1007628631] old_ccname: [KEYRING:persistent:<wbr>1007628631] keytab: [/etc/krb5.keytab]</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [switch_creds] (0x0200): Switch user to [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [switch_creds] (0x0200): Switch user to [0][0].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [k5c_check_old_ccache] (0x4000): Ccache_file is [KEYRING:persistent:<wbr>1007628631] and is not active and TGT is valid.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [become_user] (0x0200): Trying to become user [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [main] (0x2000): Running as [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [become_user] (0x0200): Trying to become user [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [become_user] (0x0200): Already user [1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [k5c_setup] (0x2000): Running as [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [main] (0x0400): Will perform offline auth</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [create_empty_ccache] (0x1000): Existing ccache still valid, reusing</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [k5c_send_data] (0x0200): Received error code 0</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [pack_response_packet] (0x2000): response packet size: [53]</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [k5c_send_data] (0x4000): Response sent.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [main] (0x0400): krb5_child completed successfully</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [main] (0x0400): krb5_child started.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [unpack_buffer] (0x1000): total buffer size: [54]</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [unpack_buffer] (0x0100): cmd [249] uid [1007628631] gid [1007628631] validate [true] enterprise principal [false] offline [true] UPN [karan.b@MYDOMAIN COM]</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [become_user] (0x0200): Trying to become user [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [main] (0x2000): Running as [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [become_user] (0x0200): Trying to become user [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [become_user] (0x0200): Already user [1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [k5c_setup] (0x2000): Running as [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [main] (0x0400): Will perform pre-auth</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [tgt_req_child] (0x1000): Attempting to get a TGT</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [MYDOMAIN COM]</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [sss_child_krb5_trace_cb] (0x4000): [6881] 1479301599.494908: Getting initial credentials for karan.b@MYDOMAIN COM</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [sss_child_krb5_trace_cb] (0x4000): [6881] 1479301599.496903: Sending request (167 bytes) to MYDOMAIN COM</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [sss_child_krb5_trace_cb] (0x4000): [6881] 1479301599.497962: Retrying AS request with master KDC</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [sss_child_krb5_trace_cb] (0x4000): [6881] 1479301599.497985: Getting initial credentials for karan.b@MYDOMAIN COM</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [sss_child_krb5_trace_cb] (0x4000): [6881] 1479301599.498026: Sending request (167 bytes) to MYDOMAIN COM (master)</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [get_and_save_tgt] (0x0400): krb5_get_init_creds_password returned [-1765328230} during pre-auth.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [k5c_send_data] (0x0200): Received error code 0</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [pack_response_packet] (0x2000): response packet size: [4]</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [k5c_send_data] (0x4000): Response sent.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [main] (0x0400): krb5_child completed successfully</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [main] (0x0400): krb5_child started.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [unpack_buffer] (0x1000): total buffer size: [159]</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [unpack_buffer] (0x0100): cmd [241] uid [1007628631] gid [1007628631] validate [true] enterprise principal [false] offline [true] UPN [karan.b@MYDOMAIN COM]</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [unpack_buffer] (0x0100): ccname: [KEYRING:persistent:<wbr>1007628631] old_ccname: [KEYRING:persistent:<wbr>1007628631] keytab: [/etc/krb5.keytab]</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [switch_creds] (0x0200): Switch user to [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [switch_creds] (0x0200): Switch user to [0][0].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [k5c_check_old_ccache] (0x4000): Ccache_file is [KEYRING:persistent:<wbr>1007628631] and is not active and TGT is valid.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [become_user] (0x0200): Trying to become user [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [main] (0x2000): Running as [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [become_user] (0x0200): Trying to become user [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [become_user] (0x0200): Already user [1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [k5c_setup] (0x2000): Running as [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [main] (0x0400): Will perform offline auth</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [create_empty_ccache] (0x1000): Existing ccache still valid, reusing</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [k5c_send_data] (0x0200): Received error code 0</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [pack_response_packet] (0x2000): response packet size: [53]</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [k5c_send_data] (0x4000): Response sent.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [main] (0x0400): krb5_child completed successfully</div></div></div><div class="gmail_extra"><div><div class="h5"><br><div class="gmail_quote">On Wed, Nov 16, 2016 at 1:02 PM, <span dir="ltr"><<a href="mailto:freeipa-users-request@redhat.com" target="_blank">freeipa-users-request@redhat.<wbr>com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>Send Freeipa-users mailing list submissions to<br> <a href="mailto:freeipa-users@redhat.com" target="_blank">freeipa-users@redhat.com</a><br> <br> To subscribe or unsubscribe via the World Wide Web, visit<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman<wbr>/listinfo/freeipa-users</a><br> or, via email, send a message with subject or body 'help' to<br> <a href="mailto:freeipa-users-request@redhat.com" target="_blank">freeipa-users-request@redhat.c<wbr>om</a><br> <br> You can reach the person managing the list at<br> <a href="mailto:freeipa-users-owner@redhat.com" target="_blank">freeipa-users-owner@redhat.com</a><br> <br> When replying, please edit your Subject line so it is more specific<br> than "Re: Contents of Freeipa-users digest..."<br> <br> <br> Today's Topics:<br> <br> </span> 1. Client x.x.xx - RFC 1918 response from Internet in<br> /var/log/messages (Bjarne Blichfeldt)<br> 2. Re: pam_winbind(sshd:auth): pam_get_item returned a password<br> (Sumit Bose)<br> <br> <br> ------------------------------<wbr>------------------------------<wbr>----------<br> <br> Message: 1<br> Date: Wed, 16 Nov 2016 11:56:05 +0000<br> From: Bjarne Blichfeldt <<a href="mailto:BJB@jndata.dk" target="_blank">BJB@jndata.dk</a>><br> To: "<a href="mailto:freeipa-users@redhat.com" target="_blank">freeipa-users@redhat.com</a>" <<a href="mailto:freeipa-users@redhat.com" target="_blank">freeipa-users@redhat.com</a>><br> Subject: [Freeipa-users] Client x.x.xx - RFC 1918 response from<br> Internet in /var/log/messages<br> Message-ID:<br> <<a href="mailto:89213DDB84447F44A8E8950A5C2185E0482EB1EE@SJN01013.jnmain00.corp.jndata.net" target="_blank">89213DDB84447F44A8E8950A5C218<wbr>5E0482EB1EE@SJN01013.jnmain00.<wbr>corp.jndata.net</a>><br> <br> Content-Type: text/plain; charset="us-ascii"<br> <br> Just updated a couple of free-ipa servers to:<br> <a href="http://ipa-server-dns-4.4.0-12.el7.no">ipa-server-dns-4.4.0-12.el7.no</a><wbr>arch<br> redhat-release-server-7.3-7.el<wbr>7.x86_64<br> <br> Before the update, I resolved the issue with RFC messages by:<br> /etc/named.conf:<br> options {<br> disable-empty-zone "10.in-addr.arpa.";<br> :<br> <br> Now after the update the RFS messages has returned. I read in the changelog for 4.4 that this issue was resolved.<br> What did I miss?<br> <br> <br> <br> <br> <br> <br> Venlig hilsen<br> <br> <br> Bjarne Blichfeldt<br> <br> <br> Infrastructure Services<br> <br> <br> <br> Direkte <a href="tel:%2B4563636119" value="+4563636119" target="_blank">+4563636119</a><br> <br> <br> Mobile <a href="tel:%2B4521593270" value="+4521593270" target="_blank">+4521593270</a><br> <br> <br> <a href="mailto:BJB@jndata.dk" target="_blank">BJB@jndata.dk</a><br> <br> [cid:image005.png@01D24008.CA6<wbr>EF0F0]<br> <br> JN Data A/S<br> <br> *<br> <br> Havsteensvej 4<br> <br> *<br> <br> 4000 Roskilde<br> <br> <br> Telefon 63 63 63 63/ Fax 63 63 63 64<br> <br> <br> <a href="http://www.jndata.dk" rel="noreferrer" target="_blank">www.jndata.dk</a><br> <br> <br> [cid:image006.png@01D24008.CA6<wbr>EF0F0]<br> <span>-------------- next part --------------<br> An HTML attachment was scrubbed...<br> </span>URL: <<a href="https://www.redhat.com/archives/freeipa-users/attachments/20161116/46aeee39/attachment.html" rel="noreferrer" target="_blank">https://www.redhat.com/archiv<wbr>es/freeipa-users/attachments/<wbr>20161116/46aeee39/attachment.<wbr>html</a>><br> -------------- next part --------------<br> A non-text attachment was scrubbed...<br> Name: image005.png<br> Type: image/png<br> Size: 410 bytes<br> Desc: image005.png<br> URL: <<a href="https://www.redhat.com/archives/freeipa-users/attachments/20161116/46aeee39/attachment.png" rel="noreferrer" target="_blank">https://www.redhat.com/archiv<wbr>es/freeipa-users/attachments/<wbr>20161116/46aeee39/attachment.<wbr>png</a>><br> -------------- next part --------------<br> A non-text attachment was scrubbed...<br> Name: image006.png<br> Type: image/png<br> Size: 5487 bytes<br> Desc: image006.png<br> URL: <<a href="https://www.redhat.com/archives/freeipa-users/attachments/20161116/46aeee39/attachment-0001.png" rel="noreferrer" target="_blank">https://www.redhat.com/archiv<wbr>es/freeipa-users/attachments/<wbr>20161116/46aeee39/attachment-<wbr>0001.png</a>><br> <br> ------------------------------<br> <br> Message: 2<br> Date: Wed, 16 Nov 2016 13:01:59 +0100<br> From: Sumit Bose <<a href="mailto:sbose@redhat.com" target="_blank">sbose@redhat.com</a>><br> To: <a href="mailto:freeipa-users@redhat.com" target="_blank">freeipa-users@redhat.com</a><br> Subject: Re: [Freeipa-users] pam_winbind(sshd:auth): pam_get_item<br> returned a password<br> Message-ID:<br> <20161116120159.GL28171@p.Spee<wbr>dport_W_724V_Typ_A_05011603_<wbr>00_009><br> Content-Type: text/plain; charset=us-ascii<br> <span><br> On Wed, Nov 16, 2016 at 12:49:59PM +0100, rajat gupta wrote:<br> > I am using FreeIPA version 4.4.0 Active Directory trust setup. And on<br> > Active Directory side I am using UPN suffix.<br> > Following are my domain setup.<br> ><br> > AD DOMANIN :- <a href="http://corp.addomain.com" rel="noreferrer" target="_blank">corp.addomain.com</a><br> > UPN suffix :- <a href="mailto:username@mydomain.com" target="_blank">username@mydomain.com</a><br> > IPA DOMAIN :- ipa.ipadomain.local<br> > IPA server hostname:- ilt-gif-ipa01.ipa.ipadomain.lo<wbr>cal<br> <br> </span>When you call 'ipa trust-find' on the IPA server do you see the<br> <a href="http://mydomain.com" rel="noreferrer" target="_blank">mydomain.com</a> UPN suffix listed, like e.g.:<br> <br> # ipa trust-find<br> ---------------<br> 1 trust matched<br> ---------------<br> Realm-Name: ad.devel<br> Domain NetBIOS name: AD<br> Domain Security Identifier: S-1-5-21-3692237560-1981608775<wbr>-3610128199<br> Trust type: Active Directory domain<br> UPN suffixes: alt.alt, alt.upn.suffix<br> <br> SSSD 1.14 and above on the IPA client should enable enterprise principal<br> support automatically if UPN suffixes are found on the server but according to<br> <span><br> (0x0100): cmd [241] uid [1007656917] gid [1007656917] validate [true] enterprise principal [false] offline [false] UPN [<a href="mailto:Rajat.Gupta@MYDOMAIN.COM" target="_blank">Rajat.Gupta@MYDOMAIN.COM</a>]<br> <br> </span>it is not. If the UPN suffixes are not know on the server, calling 'ipa<br> trust-fetch-domains' might help to get them. If there are still no UPN suffixes<br> available on the server you can switch on enterprise principal on the client<br> manually by adding 'krb5_use_enterprise_principal = True' in the [domain/...]<br> section of sssd.conf. You have to set it manually as well if you are using<br> older versions of SSSD.<br> <br> HTH<br> <br> bye,<br> Sumit<br> <div><div class="m_-5578805750649884857h5"><br> ><br> ><br> > I am able to login with AD user on IPA server. But on IPA clinet i am not<br> > able to login i am getting the login message "Access denied". I have<br> > enabled the debug_level on sssd.conf on ipa clinet.<br> ><br> > below are some logs..<br> > ================<br> > /var/log/secure<br> ><br> > Nov 16 09:00:52 ipa-clinet1 sshd[3752]: pam_sss(sshd:auth): authentication<br> > failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x user=rg1989<br> > Nov 16 09:00:52 ipa-clinet1 sshd[3752]: pam_sss(sshd:auth): received for<br> > user e600336: 6 (Permission denied)<br> > Nov 16 09:00:52 ipa-clinet1 sshd[3752]: pam_winbind(sshd:auth): getting<br> > password (0x00000010)<br> > Nov 16 09:00:52 ipa-clinet1 sshd[3752]: pam_winbind(sshd:auth):<br> > pam_get_item returned a password<br> > Nov 16 09:00:52 ipa-clinet1 sshd[3752]: pam_winbind(sshd:auth): internal<br> > module error (retval = PAM_AUTHINFO_UNAVAIL(9), user = 'rg1989')<br> > Nov 16 09:00:52 ipa-clinet1 sshd[3752]: Failed password for e600336 from<br> > x.x.x.x. port 48842 ssh2<br> > ================<br> ><br> > ================<br> > krb5_child.log<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4836]]]] [k5c_send_data]<br> > (0x4000): Response sent.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4836]]]] [main] (0x0400):<br> > krb5_child completed successfully<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [main] (0x0400):<br> > krb5_child started.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [unpack_buffer]<br> > (0x1000): total buffer size: [159]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [unpack_buffer]<br> > (0x0100): cmd [241] uid [1007656917] gid [1007656917] validate [true]<br> > enterprise principal [false] offline [false] UPN [<a href="mailto:Rajat.Gupta@MYDOMAIN.COM" target="_blank">Rajat.Gupta@MYDOMAIN.COM</a>]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [unpack_buffer]<br> > (0x0100): ccname: [KEYRING:persistent:1007656917<wbr>] old_ccname:<br> > [KEYRING:persistent:1007656917<wbr>] keytab: [/etc/krb5.keytab]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [switch_creds]<br> > (0x0200): Switch user to [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [switch_creds]<br> > (0x0200): Switch user to [0][0].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [k5c_check_old_ccache] (0x4000): Ccache_file is<br> > [KEYRING:persistent:1007656917<wbr>] and is not active and TGT is valid.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [k5c_precreate_ccache] (0x4000): Recreating ccache<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [k5c_setup_fast]<br> > (0x0100): SSSD_KRB5_FAST_PRINCIPAL is set to<br> > [host/ipa-clinet1.ipa.ipadomai<wbr>n.local@IPA.IPADOMAIN.LOCAL]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [find_principal_in_keytab] (0x4000): Trying to find principal<br> > host/ipa-clinet1.ipa.ipadomain<wbr>.local@IPA.IPADOMAIN.LOCAL in keytab.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [match_principal]<br> > (0x1000): Principal matched to the sample<br> > (host/ipa-clinet1.ipa.ipadomai<wbr>n.local@IPA.IPADOMAIN.LOCAL).<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [check_fast_ccache]<br> > (0x0200): FAST TGT is still valid.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [become_user]<br> > (0x0200): Trying to become user [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [main] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [k5c_setup] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME]<br> > from environment.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from<br> > environment.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to [true]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [main] (0x0400): Will<br> > perform online auth<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [tgt_req_child]<br> > (0x1000): Attempting to get a TGT<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [get_and_save_tgt]<br> > (0x0400): Attempting kinit for realm [<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a>]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.416687: Getting<br> > initial credentials for <a href="mailto:Rajat.Gupta@MYDOMAIN.COM" target="_blank">Rajat.Gupta@MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.418641: FAST armor<br> > ccache: MEMORY:/var/lib/sss/db/fast_cc<wbr>ache_IPA.IPADOMAIN.LOCAL<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.418698: Retrieving<br> > host/ipa-clinet1.ipa.ipadomain<wbr>.local@IPA.IPADOMAIN.LOCAL -><br> > krb5_ccache_conf_data/fast_ava<wbr>il/krbtgt\/<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a><br> > \@MYDOMAIN.COM@X-CACHECONF: from<br> > MEMORY:/var/lib/sss/db/fast_cc<wbr>ache_IPA.IPADOMAIN.LOCAL with result:<br> > -1765328243/Matching credential not found<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.418756: Sending<br> > request (164 bytes) to <a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.419718: Retrying AS<br> > request with master KDC<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.419752: Getting<br> > initial credentials for <a href="mailto:Rajat.Gupta@MYDOMAIN.COM" target="_blank">Rajat.Gupta@MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.419778: FAST armor<br> > ccache: MEMORY:/var/lib/sss/db/fast_cc<wbr>ache_IPA.IPADOMAIN.LOCAL<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.419821: Retrieving<br> > host/ipa-clinet1.ipa.ipadomain<wbr>.local@IPA.IPADOMAIN.LOCAL -><br> > krb5_ccache_conf_data/fast_ava<wbr>il/krbtgt\/<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a><br> > \@MYDOMAIN.COM@X-CACHECONF: from<br> > MEMORY:/var/lib/sss/db/fast_cc<wbr>ache_IPA.IPADOMAIN.LOCAL with result:<br> > -1765328243/Matching credential not found<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.419859: Sending<br> > request (164 bytes) to <a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a> (master)<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [get_and_save_tgt]<br> > (0x0020): 1296: [-1765328230][Cannot find KDC for realm "<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a>"]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [map_krb5_error]<br> > (0x0020): 1365: [-1765328230][Cannot find KDC for realm "<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a>"]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [k5c_send_data]<br> > (0x0200): Received error code 1432158228<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [pack_response_packet] (0x2000): response packet size: [4]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [k5c_send_data]<br> > (0x4000): Response sent.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [main] (0x0400):<br> > krb5_child completed successfully<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [main] (0x0400):<br> > krb5_child started.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [unpack_buffer]<br> > (0x1000): total buffer size: [159]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [unpack_buffer]<br> > (0x0100): cmd [241] uid [1007656917] gid [1007656917] validate [true]<br> > enterprise principal [false] offline [false] UPN [<a href="mailto:Rajat.Gupta@MYDOMAIN.COM" target="_blank">Rajat.Gupta@MYDOMAIN.COM</a>]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [unpack_buffer]<br> > (0x0100): ccname: [KEYRING:persistent:1007656917<wbr>] old_ccname:<br> > [KEYRING:persistent:1007656917<wbr>] keytab: [/etc/krb5.keytab]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [switch_creds]<br> > (0x0200): Switch user to [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [switch_creds]<br> > (0x0200): Switch user to [0][0].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [k5c_check_old_ccache] (0x4000): Ccache_file is<br> > [KEYRING:persistent:1007656917<wbr>] and is not active and TGT is valid.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [k5c_precreate_ccache] (0x4000): Recreating ccache<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [k5c_setup_fast]<br> > (0x0100): SSSD_KRB5_FAST_PRINCIPAL is set to<br> > [host/ipa-clinet1.ipa.ipadomai<wbr>n.local@IPA.IPADOMAIN.LOCAL]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [find_principal_in_keytab] (0x4000): Trying to find principal<br> > host/ipa-clinet1.ipa.ipadomain<wbr>.local@IPA.IPADOMAIN.LOCAL in keytab.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [match_principal]<br> > (0x1000): Principal matched to the sample<br> > (host/ipa-clinet1.ipa.ipadomai<wbr>n.local@IPA.IPADOMAIN.LOCAL).<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [check_fast_ccache]<br> > (0x0200): FAST TGT is still valid.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [become_user]<br> > (0x0200): Trying to become user [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [main] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [k5c_setup] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME]<br> > from environment.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from<br> > environment.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to [true]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [main] (0x0400): Will<br> > perform online auth<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [tgt_req_child]<br> > (0x1000): Attempting to get a TGT<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [get_and_save_tgt]<br> > (0x0400): Attempting kinit for realm [<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a>]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.426870: Getting<br> > initial credentials for <a href="mailto:Rajat.Gupta@MYDOMAIN.COM" target="_blank">Rajat.Gupta@MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.428706: FAST armor<br> > ccache: MEMORY:/var/lib/sss/db/fast_cc<wbr>ache_IPA.IPADOMAIN.LOCAL<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.428762: Retrieving<br> > host/ipa-clinet1.ipa.ipadomain<wbr>.local@IPA.IPADOMAIN.LOCAL -><br> > krb5_ccache_conf_data/fast_ava<wbr>il/krbtgt\/<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a><br> > \@MYDOMAIN.COM@X-CACHECONF: from<br> > MEMORY:/var/lib/sss/db/fast_cc<wbr>ache_IPA.IPADOMAIN.LOCAL with result:<br> > -1765328243/Matching credential not found<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.428825: Sending<br> > request (164 bytes) to <a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.429706: Retrying AS<br> > request with master KDC<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.429740: Getting<br> > initial credentials for <a href="mailto:Rajat.Gupta@MYDOMAIN.COM" target="_blank">Rajat.Gupta@MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.429767: FAST armor<br> > ccache: MEMORY:/var/lib/sss/db/fast_cc<wbr>ache_IPA.IPADOMAIN.LOCAL<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.429812: Retrieving<br> > host/ipa-clinet1.ipa.ipadomain<wbr>.local@IPA.IPADOMAIN.LOCAL -><br> > krb5_ccache_conf_data/fast_ava<wbr>il/krbtgt\/<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a><br> > \@MYDOMAIN.COM@X-CACHECONF: from<br> > MEMORY:/var/lib/sss/db/fast_cc<wbr>ache_IPA.IPADOMAIN.LOCAL with result:<br> > -1765328243/Matching credential not found<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.429854: Sending<br> > request (164 bytes) to <a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a> (master)<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [get_and_save_tgt]<br> > (0x0020): 1296: [-1765328230][Cannot find KDC for realm "<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a>"]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [map_krb5_error]<br> > (0x0020): 1365: [-1765328230][Cannot find KDC for realm "<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a>"]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [k5c_send_data]<br> > (0x0200): Received error code 1432158228<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [pack_response_packet] (0x2000): response packet size: [4]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [k5c_send_data]<br> > (0x4000): Response sent.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [main] (0x0400):<br> > krb5_child completed successfully<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [main] (0x0400):<br> > krb5_child started.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [unpack_buffer]<br> > (0x1000): total buffer size: [159]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [unpack_buffer]<br> > (0x0100): cmd [241] uid [1007656917] gid [1007656917] validate [true]<br> > enterprise principal [false] offline [true] UPN [<a href="mailto:Rajat.Gupta@MYDOMAIN.COM" target="_blank">Rajat.Gupta@MYDOMAIN.COM</a>]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [unpack_buffer]<br> > (0x0100): ccname: [KEYRING:persistent:1007656917<wbr>] old_ccname:<br> > [KEYRING:persistent:1007656917<wbr>] keytab: [/etc/krb5.keytab]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [switch_creds]<br> > (0x0200): Switch user to [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]]<br> > [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [switch_creds]<br> > (0x0200): Switch user to [0][0].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]]<br> > [k5c_check_old_ccache] (0x4000): Ccache_file is<br> > [KEYRING:persistent:1007656917<wbr>] and is not active and TGT is valid.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [become_user]<br> > (0x0200): Trying to become user [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [main] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [become_user]<br> > (0x0200): Trying to become user [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [become_user]<br> > (0x0200): Already user [1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [k5c_setup] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME]<br> > from environment.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from<br> > environment.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [main] (0x0400): Will<br> > perform offline auth<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [create_empty_ccache]<br> > (0x1000): Existing ccache still valid, reusing<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [k5c_send_data]<br> > (0x0200): Received error code 0<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]]<br> > [pack_response_packet] (0x2000): response packet size: [53]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [k5c_send_data]<br> > (0x4000): Response sent.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [main] (0x0400):<br> > krb5_child completed successfully<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [main] (0x0400):<br> > krb5_child started.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [unpack_buffer]<br> > (0x1000): total buffer size: [52]<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [unpack_buffer]<br> > (0x0100): cmd [249] uid [1007656917] gid [1007656917] validate [true]<br> > enterprise principal [false] offline [true] UPN [<a href="mailto:Rajat.Gupta@MYDOMAIN.COM" target="_blank">Rajat.Gupta@MYDOMAIN.COM</a>]<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [become_user]<br> > (0x0200): Trying to become user [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [main] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [become_user]<br> > (0x0200): Trying to become user [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [become_user]<br> > (0x0200): Already user [1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [k5c_setup] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME]<br> > from environment.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from<br> > environment.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [main] (0x0400): Will<br> > perform pre-auth<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [tgt_req_child]<br> > (0x1000): Attempting to get a TGT<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [get_and_save_tgt]<br> > (0x0400): Attempting kinit for realm [<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a>]<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4840] 1479283767.766694: Getting<br> > initial credentials for <a href="mailto:Rajat.Gupta@MYDOMAIN.COM" target="_blank">Rajat.Gupta@MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4840] 1479283767.769074: Sending<br> > request (164 bytes) to <a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4840] 1479283767.770020: Retrying AS<br> > request with master KDC<br> ><br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4840] 1479283767.770051: Getting<br> > initial credentials for <a href="mailto:Rajat.Gupta@MYDOMAIN.COM" target="_blank">Rajat.Gupta@MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4840] 1479283767.770091: Sending<br> > request (164 bytes) to <a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a> (master)<br> ><br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [get_and_save_tgt]<br> > (0x0400): krb5_get_init_creds_password returned [-1765328230} during<br> > pre-auth.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [k5c_send_data]<br> > (0x0200): Received error code 0<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]]<br> > [pack_response_packet] (0x2000): response packet size: [4]<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [k5c_send_data]<br> > (0x4000): Response sent.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [main] (0x0400):<br> > krb5_child completed successfully<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [main] (0x0400):<br> > krb5_child started.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [unpack_buffer]<br> > (0x1000): total buffer size: [160]<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [unpack_buffer]<br> > (0x0100): cmd [241] uid [1007656917] gid [1007656917] validate [true]<br> > enterprise principal [false] offline [true] UPN [<a href="mailto:Rajat.Gupta@MYDOMAIN.COM" target="_blank">Rajat.Gupta@MYDOMAIN.COM</a>]<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [unpack_buffer]<br> > (0x0100): ccname: [KEYRING:persistent:1007656917<wbr>] old_ccname:<br> > [KEYRING:persistent:1007656917<wbr>] keytab: [/etc/krb5.keytab]<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [switch_creds]<br> > (0x0200): Switch user to [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]]<br> > [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [switch_creds]<br> > (0x0200): Switch user to [0][0].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]]<br> > [k5c_check_old_ccache] (0x4000): Ccache_file is<br> > [KEYRING:persistent:1007656917<wbr>] and is not active and TGT is valid.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [become_user]<br> > (0x0200): Trying to become user [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [main] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [become_user]<br> > (0x0200): Trying to become user [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [become_user]<br> > (0x0200): Already user [1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [k5c_setup] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME]<br> > from environment.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from<br> > environment.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [main] (0x0400): Will<br> > perform offline auth<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [create_empty_ccache]<br> > (0x1000): Existing ccache still valid, reusing<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [k5c_send_data]<br> > (0x0200): Received error code 0<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]]<br> > [pack_response_packet] (0x2000): response packet size: [53]<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [k5c_send_data]<br> > (0x4000): Response sent.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [main] (0x0400):<br> > krb5_child completed successfully<br> ><br> > =======================<br> > Can you please help me to fix this,<br> <br> > --<br> </div></div>> Manage your subscription for the Freeipa-users mailing list:<br> > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman<wbr>/listinfo/freeipa-users</a><br> > Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br> <div class="m_-5578805750649884857HOEnZb"><div class="m_-5578805750649884857h5"><br> <br> <br> ------------------------------<br> <br> ______________________________<wbr>_________________<br> Freeipa-users mailing list<br> <a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman<wbr>/listinfo/freeipa-users</a><br> <br> End of Freeipa-users Digest, Vol 100, Issue 48<br> ******************************<wbr>****************<br> </div></div></blockquote></div><br><br clear="all"><div><br></div></div></div><span class="HOEnZb"><font color="#888888">-- <br><div class="m_-5578805750649884857gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><b>Rajat Gupta<br> </b><b><img style="margin:0pt 0.2ex;vertical-align:middle" src="http://../1/e/330"></b></div></div> </font></span></div> </blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><b>Rajat Gupta<br> </b><b><img style="margin:0pt 0.2ex;vertical-align:middle" src="http://../1/e/330"></b></div></div> </div>