On Mon, Dec 03, 2018 at 08:00:51AM -0000, Peter de Groot wrote:
> 
> Please help.. desperate..
> 
> Installed sssd (version 1.16.1) on ubuntu authing against AD.
> 
> Problem .. and this appears to be only one user..
> 
> 1. Login with the user..  No trouble
> 2. log out and try to login again.
> 3. Before even asking for a password, it comes up with access denied.
> 
> The only way I can fix this is to do a sssctl cache-remove.  And then I can 
> log in again.
> Rinse and repeat.  It seems to be a dud entry in the cache ?
> 
> After days of trawling the logs... the only thing that seem to leap out is 
> this in the krb5 logs.  That entry in the salt is e4182s01sv023.  The machine 
> is called e418201sv025  ???  Where is it getting the 23 from ?  We do have a 
> host with that name on the network.. but not this one...
> 
> (Mon Dec  3 15:29:29 2018) [[sssd[krb5_child[11596]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11596] 1543822169.407460: Selected etype 
> info: etype aes256-cts, salt "ORANGE.SCHOOLS.INTERNALpeter.de.groot", params 
> ""
> (Mon Dec  3 15:29:29 2018) [[sssd[krb5_child[11596]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11596] 1543822169.407479: Selected etype 
> info: etype aes256-cts, salt "ORANGE.SCHOOLS.INTERNALpeter.de.groot", params 
> ""
> (Mon Dec  3 15:30:13 2018) [[sssd[krb5_child[11746]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11746] 1543822213.745198: Selected etype 
> info: etype aes256-cts, salt 
> "ORANGE.SCHOOLS.INTERNALhoste4182s01sv023.orange.schools.internal", params ""
> (Mon Dec  3 15:30:13 2018) [[sssd[krb5_child[11746]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11746] 1543822213.745213: Selected etype 
> info: etype aes256-cts, salt 
> "ORANGE.SCHOOLS.INTERNALhoste4182s01sv023.orange.schools.internal", params ""
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851028: Selected etype 
> info: etype aes256-cts, salt 
> "ORANGE.SCHOOLS.INTERNALhoste4182s01sv023.orange.schools.internal", params ""
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851043: Selected etype 
> info: etype aes256-cts, salt 
> "ORANGE.SCHOOLS.INTERNALhoste4182s01sv023.orange.schools.internal", params ""

Do you have entries for e4182s01sv023 in the keytab? You can check with
'klist -k'

HTH

bye,
Sumit

> 
> The bottom of the log file
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851023: Received error 
> from KDC: -1765328359/Additional pre-authenticat
> ion required
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851026: 
> Preauthenticating using KDC method data
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851027: Processing 
> preauth types: 16, 15, 19, 2
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851028: Selected etype 
> info: etype aes256-cts, salt "ORANGE.SCHOOLS.INT
> ERNALhoste4182s01sv023.orange.schools.internal", params ""
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] [sss_krb5_responder] 
> (0x4000): Got question [password].
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851029: AS key 
> obtained for encrypted timestamp: aes256-cts/BBF9
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851031: Encrypted 
> timestamp (for 1543822221.598566): plain 301AA011180F
> 32303138313230333037333032315AA1050203092226, encrypted 
> 89607EC763BD323A282F20C7ED58C75EA84F1638692A5CBCBF13BCF6F079891B1E2D140825C5E518334D7B138560D6E8ACA09F77315D131B
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851032: Preauth module 
> encrypted_timestamp (2) (real) returned: 0/Succe
> ss
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851033: Produced 
> preauth for next request: 2
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851034: Sending 
> request (302 bytes) to ORANGE.SCHOOLS.INTERNAL
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851035: Sending 
> initial UDP request to dgram 10.251.17.2:88
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851036: Received 
> answer (221 bytes) from dgram 10.251.17.2:88
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851037: Response was 
> from master KDC
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851038: Received error 
> from KDC: -1765328360/Preauthentication failed
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851041: 
> Preauthenticating using KDC method data
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851042: Processing 
> preauth types: 19
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_child_krb5_trace_cb] (0x4000): [11747] 1543822219.851043: Selected etype 
> info: etype aes256-cts, salt "ORANGE.SCHOOLS.INT
> ERNALhoste4182s01sv023.orange.schools.internal", params ""
> 
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] 
> [sss_krb5_get_init_creds_password] (0x0020): 1618: 
> [-1765328360][Preauthentication failed]
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] [get_and_save_tgt] 
> (0x0020): 1695: [-1765328360][Preauthentication failed]
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] [map_krb5_error] 
> (0x0020): 1808: [-1765328360][Preauthentication failed]
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] [k5c_send_data] 
> (0x0200): Received error code 1432158221
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] [pack_response_packet] 
> (0x2000): response packet size: [4]
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] [k5c_send_data] 
> (0x4000): Response sent.
> (Mon Dec  3 15:30:19 2018) [[sssd[krb5_child[11747]]]] [main] (0x0400): 
> krb5_child completed successfully
> 
> roo
> _______________________________________________
> sssd-users mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: 
> https://lists.fedorahosted.org/archives/list/[email protected]
_______________________________________________
sssd-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/[email protected]

Reply via email to