Active directory broken

NethServer Version: NethServer release 7.5.1804 (final)
Module: nethserver-sssd nethserver-dc

After having installed the cockpit preview I was curious and went into the ActiveDirectory portion of it, just to be greeted by a error mentioning that I had no SSSD account provider…

I then went back to the normal nethserver gui (on port 980) and seen to my shock and horror that indeed, the whole AD had gone.

I tried simply re-runnning the wizard but this failed as mentioned below the following output:

“config show nsdc” output:

nsdc=service
        IpAddress=172.24.2.2
        ProvisionType=newdomain
        bridge=br0
        status=enabled

config show sssd output:

    sssd=service
        AdDns=172.24.2.2
        BindDN=ldapservice@HOME.MITOS-KALANDIEL.ME
        BindPassword=W5fB2XeA7MWCfGyW
        DiscoverDcType=ldapuri
        LdapURI=ldaps://nsdc-daffy.home.mitos-kalandiel.me
        Provider=ad
        Realm=HOME.MITOS-KALANDIEL.ME
        Workgroup=HOME
        status=enabled

“config show smb” output:

smb=service
AuditAlias=839432e488a7ba75d7e01b987ef730bbefdb2932
DeadTime=10080
HomeAdmStatus=enabled
InheritOwner=yes
NetbiosAliasList=
OsLevel=35
ServerRole=WS
ShareAdmStatus=enabled
Sid=
TCPPorts=139,445
UseClientDriver=yes
UseCups=enabled
WinsServerIP=
access=green
status=enabled

“db networks show” output:

172.17.0.0=network
    Description=Docker environment
    Mask=255.255.255.0
94.229.75.137=network
    Description=HAL9000 server from enoctus
    Mask=255.255.255.255
br0=bridge
    gateway=
    ipaddr=172.24.2.1
    netmask=255.255.255.0
    role=green
enp2s0=ethernet
    FwInBandwidth=
    FwOutBandwidth=
    bridge=br0
    role=bridged
enp3s0=ethernet
    FwInBandwidth=
    FwOutBandwidth=
    bootproto=dhcp
    gateway=192.168.10.1
    ipaddr=192.168.10.17
    netmask=255.255.255.0
    role=red
ppp0=xdsl-disabled
    AuthType=auto
    FwInBandwidth=
    FwOutBandwidth=
    Password=
    name=PPPoE
    provider=xDSL provider
    role=red
    user=
tt1=provider
    interface=enp3s0
    weight=1

“/etc/sssd/sssd.conf” is empty for some reason
I’ve followed the instructions here to do a factory reset of the DC and then re-run the “first-time wizard” for creating an AD based DC and it fails due to plexmediaserver (which i have removed and also done “config delete plexmediaserver && signal-event firewall-adjust”) and dovecot.

I’ve been at this for some hours now and cannot get back to a working DC, I don’t care if its empty I would just like to avoid a re-install from scratch.

If anything else is needed please let me know and I will provide information where available…

template-expand /etc/sssd/sssd.conf has now filled my sssd.conf as follows :

# ================= DO NOT MODIFY THIS FILE =================
#
# Manual changes will be lost when this file is regenerated.
#
# Please read the developer's guide, which is available
# at NethServer official site: https://www.nethserver.org
#
#


[sssd]
domains = home.mitos-kalandiel.me
config_file_version = 2
services = nss, pam
default_domain_suffix = home.mitos-kalandiel.me

[domain/home.mitos-kalandiel.me]
use_fully_qualified_names = True
id_provider = ad
access_provider = ad
ad_domain = home.mitos-kalandiel.me
krb5_realm = HOME.MITOS-KALANDIEL.ME
krb5_store_password_if_offline = True
ldap_id_mapping = True
ad_maximum_machine_account_password_age = 0
ad_server = nsdc-daffy.home.mitos-kalandiel.me
cache_credentials = True
override_homedir = /var/lib/nethserver/home/%u
default_shell = /usr/libexec/openssh/sftp-server
realmd_tags = manages-system joined-with-samba


[nss]
filter_users = ldapservice

“systemctl restart sssd” yielded in an error as follows from “journalctl -xe”:

Sep 21 16:02:35 daffy.home.mitos-kalandiel.me sssd[be[home.mitos-kalandiel.me]][27869]: Failed to read keytab [default]: No such file or directory
Sep 21 16:02:35 daffy.home.mitos-kalandiel.me sssd[27778]: Exiting the SSSD. Could not restart critical service [home.mitos-kalandiel.me].
Sep 21 16:02:35 daffy.home.mitos-kalandiel.me systemd[1]: sssd.service: main process exited, code=exited, status=1/FAILURE
Sep 21 16:02:35 daffy.home.mitos-kalandiel.me systemd[1]: Failed to start System Security Services Daemon.
-- Subject: Unit sssd.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit sssd.service has failed.
--
-- The result is failed.
Sep 21 16:02:35 daffy.home.mitos-kalandiel.me systemd[1]: Unit sssd.service entered failed state.
Sep 21 16:02:35 daffy.home.mitos-kalandiel.me systemd[1]: sssd.service failed.
Sep 21 16:02:35 daffy.home.mitos-kalandiel.me polkitd[1004]: Unregistered Authentication Agent for unix-process:27771:310891 (system bus name :1.170, object path /org/freedesktop/Polic

The output from “/usr/sbin/sssd -i -d7” gave the following log output :

(Fri Sep 21 17:37:13:470332 2018) [sssd] [become_user] (0x0200): Already user [0].
(Fri Sep 21 17:37:13 2018) [sssd[nss]] [sss_names_init_from_args] (0x0100): Using re [(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))].
(Fri Sep 21 17:37:13 2018) [sssd[nss]] [sss_fqnames_init] (0x0100): Using fq format [%1$s@%2$s].
(Fri Sep 21 17:37:13 2018) [sssd[nss]] [sss_process_init] (0x0400): Responder initialization complete (explicitly configured)
(Fri Sep 21 17:37:13 2018) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name 'ldapservice' matched without domain, user is ldapservice
(Fri Sep 21 17:37:13 2018) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): using default domain [home.mitos-kalandiel.me]
(Fri Sep 21 17:37:13 2018) [sssd[nss]] [sss_domain_get_state] (0x1000): Domain home.mitos-kalandiel.me is Active
(Fri Sep 21 17:37:13 2018) [sssd[nss]] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/home.mitos-kalandiel.me/ldapservice@home.mitos-kalandiel.me] to negative cache permanently
(Fri Sep 21 17:37:13 2018) [sssd[nss]] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/home.mitos-kalandiel.me/root@home.mitos-kalandiel.me] to negative cache permanently
(Fri Sep 21 17:37:13 2018) [sssd[nss]] [sss_ncache_set_str] (0x0400): Adding [NCE/GROUP/home.mitos-kalandiel.me/root@home.mitos-kalandiel.me] to negative cache permanently
(Fri Sep 21 17:37:13 2018) [sssd[nss]] [sss_ncache_set_str] (0x0400): Adding [NCE/UID/0] to negative cache permanently
(Fri Sep 21 17:37:13 2018) [sssd[nss]] [sss_ncache_set_str] (0x0400): Adding [NCE/GID/0] to negative cache permanently
(Fri Sep 21 17:37:13 2018) [sssd] [mt_svc_exit_handler] (0x1000): SIGCHLD handler of service home.mitos-kalandiel.me called
(Fri Sep 21 17:37:13 2018) [sssd] [svc_child_info] (0x0040): Child [22202] exited with code [3]
(Fri Sep 21 17:37:13 2018) [sssd] [monitor_restart_service] (0x0010): Process [home.mitos-kalandiel.me], definitely stopped!
(Fri Sep 21 17:37:13 2018) [sssd] [monitor_quit] (0x0040): Returned with: 1
(Fri Sep 21 17:37:13 2018) [sssd] [monitor_quit] (0x0020): Terminating [nss][22212]
(Fri Sep 21 17:37:13:474053 2018) [sssd[pam]] [ldb] (0x0400): server_sort:Unable to register control with rootdse!
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [server_setup] (0x0400): CONFDB: /var/lib/sss/db/config.ldb
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [confdb_get_domain_internal] (0x0400): No enumeration for [home.mitos-kalandiel.me]!
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [confdb_get_domain_internal] (0x0400): Please note that when enumeration is disabled `getent passwd` does not return all users by design. See sssd.conf man page for more detailed information
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [confdb_get_domain_internal] (0x0100): Default domain suffix set. Changing default for use_fully_qualified_names to True.
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [confdb_get_domain_internal] (0x1000): pwd_expiration_warning is -1
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [sss_get_etc_shells] (0x0400): Found shell /bin/bash in /etc/shells
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [sss_get_etc_shells] (0x0400): Found shell /bin/csh in /etc/shells
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [sss_get_etc_shells] (0x0400): Found shell /bin/false in /etc/shells
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [sss_get_etc_shells] (0x0400): Found shell /sbin/nologin in /etc/shells
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [sss_get_etc_shells] (0x0400): Found shell /bin/sh in /etc/shells
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [sbus_init_connection] (0x0400): Adding connection 0x55cd5caf5e20
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.sssd.service with path /org/freedesktop/sssd/service
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [sbus_conn_register_path] (0x0400): Registering object path /org/freedesktop/sssd/service with D-Bus connection
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.DBus.Properties with path /org/freedesktop/sssd/service
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [sbus_opath_hash_add_iface] (0x0400): Registering interface org.freedesktop.DBus.Introspectable with path /org/freedesktop/sssd/service
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [monitor_common_send_id] (0x0100): Sending ID: (pam,1)
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [sss_names_init_from_args] (0x0100): Using re [(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))].
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [sss_fqnames_init] (0x0100): Using fq format [%1$s@%2$s].
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [check_file] (0x0400): lstat for [/var/lib/sss/pipes/private/sbus-dp_home.mitos-kalandiel.me] failed: [2][No such file or directory].
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [sbus_client_init] (0x0020): check_file failed for [/var/lib/sss/pipes/private/sbus-dp_home.mitos-kalandiel.me].
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [sss_dp_init] (0x0010): Failed to connect to monitor services.
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [sss_process_init] (0x0010): fatal error setting up backend connector
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [sss_responder_ctx_destructor] (0x0400): Responder is being shut down
(Fri Sep 21 17:37:13 2018) [sssd[pam]] [pam_process_init] (0x0010): sss_process_init() failed
(Fri Sep 21 17:37:13 2018) [sssd[nss]] [responder_set_fd_limit] (0x0100): Maximum file descriptors set to [8192]
(Fri Sep 21 17:37:13 2018) [sssd[nss]] [nss_process_init] (0x0400): NSS Initialization complete
(Fri Sep 21 17:37:13 2018) [sssd[nss]] [orderly_shutdown] (0x0010): SIGTERM: killing children
(Fri Sep 21 17:37:13 2018) [sssd[nss]] [sss_responder_ctx_destructor] (0x0400): Responder is being shut down
(Fri Sep 21 17:37:13 2018) [sssd] [monitor_quit] (0x0020): Child [nss] exited gracefully
(Fri Sep 21 17:37:13 2018) [sssd] [monitor_quit] (0x0020): Terminating [pam][22211]
(Fri Sep 21 17:37:13 2018) [sssd] [monitor_quit] (0x0020): Child [pam] exited gracefully
(Fri Sep 21 17:37:13 2018) [sssd] [monitor_cleanup] (0x0010): Error removing pidfile! (2 [No such file or directory])

Did you change the networks db?

network is not a valid type in networks db, you may delete the wrong networks with db networks delete 172.17.0.0 and try to restart/reset the dc.

http://docs.nethserver.org/projects/nethserver-devel/en/v7/nethserver-base.html#network

i’ve got rid of those two networks via :
db networks delete 172.17.0.0
db networks delete 94.229.75.137
signal-event interface-update

db networks show now outputs:

br0=bridge
    gateway=
    ipaddr=172.24.2.1
    netmask=255.255.255.0
    role=green
enp2s0=ethernet
    FwInBandwidth=
    FwOutBandwidth=
    bridge=br0
    role=bridged
enp3s0=ethernet
    FwInBandwidth=
    FwOutBandwidth=
    bootproto=dhcp
    gateway=192.168.10.1
    ipaddr=192.168.10.17
    netmask=255.255.255.0
    role=red
ppp0=xdsl-disabled
    AuthType=auto
    FwInBandwidth=
    FwOutBandwidth=
    Password=
    name=PPPoE
    provider=xDSL provider
    role=red
    user=
tt1=provider
    interface=enp3s0
    weight=1

I have then gone and done a full DC reset as per the documentation, and then when I try to re-run the wizard for samba AD, it tries to kick off the process and then shows me this error:

Error 404
Nethgui:

404 - Not found
1405612090+1405613538

Since this was unsucessful, I have then gone, removed the br0 interface manually from /var/lib/nethserver/db/networks so I was left with only the local loopback interface and my two hardware interfaces enp2s0 and enp3s0. After a reboot I have then attempted to run the AD Wizard again, have gave it the information required : domain: home.mitos-kalandiel.me netbios name: HOME ip address: 172.24.2.2
The wizard then runs a few things, creates the br0 interface again (as expected) and then gets stuck at ‘adjust-services’ for a long while until it errors out with :

Task completed with errors

S95nethserver-dc-waitstart #23 (exit status 256)
S96nethserver-dc-join #25 (exit status 256)
Adjust service sssd #203 (exit status 1)
    failed

Interestingly when I then go visit “Account Provider” I get this output:

Samba DC version
4.7.10
DNS domain name
home.mitos-kalandiel.me
NetBIOS domain name
HOME
Domain Controller IP address
172.24.2.2
Authentication credentials for LDAP applications
Bind DN
ldapservice@HOME.MITOS-KALANDIEL.ME
Bind Password
xxx

however when i then go and visit ‘Domain Accounts’ i simply get a message saying ‘Could not connect to accounts provider!’

My config sssd show output on a server with local AD to compare:

[root@server2 ~]# config show sssd
sssd=service
    AdDns=192.168.1.22
    BindDN=ldapservice@AD.DOMAIN.LOCAL
    BindPassword=***
    DiscoverDcType=dns
    LdapURI=
    Provider=ad
    Realm=AD.DOMAIN.LOCAL
    Workgroup=DOMAIN
    status=enabled

Where is the AD portion, I tried to reproduce but couldn’t find it… I did yum --enablerepo=nethserver-testing install nethserver-cockpit to install cockpit.

Does /etc/krb5.keytab exist?

Are there errors in /var/log/messages or in AD container log?

journalctl -M nsdc

I do not have these entries in smb configuration.

Hello and Guten Morgen Markus :grin:

To be honest Markus, I believe my AD was broken before that, but I simply went to Users and Groups and then got greeted with a similar message as this “Cannot connect to Account provider” but looking back through my own “logs” [I keep notes when i visit one of my servers and see things that are wrong and/or could be done better, to then on my next visit fix those issues.]
And i do see a note from a few months ago that when I went to the dashboard I got a red banner, mentioning that sssd had exited with result 1 (or something to that effect) so I don’t think that cockpit broke my AD but rather pointed out to me that AD was broken already… But at that point SMB and user authentication still worked so I didn’t see a need to go and touch anything. I have changed the posts title accordingly…

I have not touched my smb config manually at all, so those entries would have been created by the NS gui

Funny enough, even after a re-run of the AD wizard the only file I see is /etc/krb5.conf with this content

# ================= DO NOT MODIFY THIS FILE =================
#
# Manual changes will be lost when this file is regenerated.
#
# Please read the developer's guide, which is available
# at NethServer official site: https://www.nethserver.org
#
#
#
# 10base
#
[logging]
 default = FILE:/var/log/krb5libs.log

[libdefaults]
 default_realm = AD.HOME.MITOS-KALANDIEL.ME
 dns_lookup_realm = true
 dns_lookup_kdc = true
 ticket_lifetime = 24h
 renew_lifetime = 7d
 rdns = false
 forwardable = yes

My config show sssd output is slightly different after a re-run of the wizard

sssd=service
    AdDns=172.24.2.2
    BindDN=ldapservice@AD.HOME.MITOS-KALANDIEL.ME
    BindPassword=***
    DiscoverDcType=ldapuri
    LdapURI=ldaps://nsdc-daffy.ad.home.mitos-kalandiel.me
    Provider=ad
    Realm=AD.HOME.MITOS-KALANDIEL.ME
    Workgroup=HOME
    status=enabled

I copied part of the log from yesterday, that seems a bit suspect :

Sep 22 17:55:45 nsdc-daffy.ad.home.mitos-kalandiel.me systemd[1]: Started Domain controller provisioning.
Sep 22 17:55:45 nsdc-daffy.ad.home.mitos-kalandiel.me systemd[1]: Started Samba domain controller daemon.
Sep 22 17:55:45 nsdc-daffy.ad.home.mitos-kalandiel.me systemd[1]: Starting Samba domain controller daemon...
Sep 22 17:55:45 nsdc-daffy.ad.home.mitos-kalandiel.me systemd[1]: Reached target Multi-User System.
Sep 22 17:55:45 nsdc-daffy.ad.home.mitos-kalandiel.me systemd[1]: Starting Multi-User System.
Sep 22 17:55:45 nsdc-daffy.ad.home.mitos-kalandiel.me systemd[1]: Reached target Graphical Interface.
Sep 22 17:55:45 nsdc-daffy.ad.home.mitos-kalandiel.me systemd[1]: Starting Graphical Interface.
Sep 22 17:55:45 nsdc-daffy.ad.home.mitos-kalandiel.me systemd[1]: Starting Update UTMP about System Runlevel Changes...
Sep 22 17:55:45 nsdc-daffy.ad.home.mitos-kalandiel.me systemd[1]: Started Update UTMP about System Runlevel Changes.
Sep 22 17:55:45 nsdc-daffy.ad.home.mitos-kalandiel.me systemd[1]: Startup finished in 21.335s.
Sep 22 17:55:45 nsdc-daffy.ad.home.mitos-kalandiel.me samba[37]: samba version 4.7.10 started.
Sep 22 17:55:45 nsdc-daffy.ad.home.mitos-kalandiel.me samba[37]: Copyright Andrew Tridgell and the Samba Team 1992-2017
Sep 22 17:55:46 nsdc-daffy.ad.home.mitos-kalandiel.me samba[37]: samba: using 'standard' process model
Sep 22 17:55:46 nsdc-daffy.ad.home.mitos-kalandiel.me samba[37]: WARNING: no network interfaces found
Sep 22 17:55:46 nsdc-daffy.ad.home.mitos-kalandiel.me samba[37]: task_server_terminate: [nbtd: no network interfaces configured]
Sep 22 17:55:46 nsdc-daffy.ad.home.mitos-kalandiel.me samba[37]: Attempting to autogenerate TLS self-signed keys for https for hostname 'NSDC-DAFFY.ad.home.mitos-kalandiel.me'
Sep 22 17:55:46 nsdc-daffy.ad.home.mitos-kalandiel.me samba[37]: WARNING: no network interfaces found
Sep 22 17:55:46 nsdc-daffy.ad.home.mitos-kalandiel.me samba[37]: task_server_terminate: [kdc: no network interfaces configured]
Sep 22 17:55:46 nsdc-daffy.ad.home.mitos-kalandiel.me samba[37]: WARNING: no network interfaces found
Sep 22 17:55:46 nsdc-daffy.ad.home.mitos-kalandiel.me samba[37]: task_server_terminate: [cldapd: no network interfaces configured]
Sep 22 17:55:46 nsdc-daffy.ad.home.mitos-kalandiel.me samba[37]: Failed to bind to :::53 TCP - NT_STATUS_INVALID_PARAMETER_MIX
Sep 22 17:55:46 nsdc-daffy.ad.home.mitos-kalandiel.me winbindd[52]: [2018/09/22 17:55:46.401346,  0] ../source3/winbindd/winbindd_cache.c:3176(initialize_winbindd_cache)
Sep 22 17:55:46 nsdc-daffy.ad.home.mitos-kalandiel.me winbindd[52]:   initialize_winbindd_cache: clearing cache and re-creating with version number 2
Sep 22 17:55:47 nsdc-daffy.ad.home.mitos-kalandiel.me samba[37]: /usr/sbin/samba_dnsupdate: WARNING: no network interfaces found
Sep 22 17:55:47 nsdc-daffy.ad.home.mitos-kalandiel.me winbindd[52]: [2018/09/22 17:55:47.353181,  0] ../lib/util/become_daemon.c:124(daemon_ready)
Sep 22 17:55:47 nsdc-daffy.ad.home.mitos-kalandiel.me winbindd[52]:   STATUS=daemon 'winbindd' finished starting up and ready to serve connections
Sep 22 17:55:48 nsdc-daffy.ad.home.mitos-kalandiel.me smbd[45]: [2018/09/22 17:55:48.421691,  0] ../lib/util/become_daemon.c:124(daemon_ready)
Sep 22 17:55:48 nsdc-daffy.ad.home.mitos-kalandiel.me smbd[45]:   STATUS=daemon 'smbd' finished starting up and ready to serve connections
Sep 22 17:55:48 nsdc-daffy.ad.home.mitos-kalandiel.me smbd[45]: [2018/09/22 17:55:48.435392,  0] ../source3/lib/util_sock.c:334(open_socket_in)
Sep 22 17:55:48 nsdc-daffy.ad.home.mitos-kalandiel.me smbd[45]:   open_socket_in(): socket() call failed: Address family not supported by protocol
Sep 22 17:55:48 nsdc-daffy.ad.home.mitos-kalandiel.me smbd[45]: [2018/09/22 17:55:48.435763,  0] ../source3/smbd/server.c:1093(smbd_open_one_socket)
Sep 22 17:55:48 nsdc-daffy.ad.home.mitos-kalandiel.me smbd[45]:   smbd_open_one_socket: open_socket_in: Address family not supported by protocol
Sep 22 17:55:48 nsdc-daffy.ad.home.mitos-kalandiel.me smbd[45]: [2018/09/22 17:55:48.442820,  0] ../source3/lib/util_sock.c:334(open_socket_in)
Sep 22 17:55:48 nsdc-daffy.ad.home.mitos-kalandiel.me smbd[45]:   open_socket_in(): socket() call failed: Address family not supported by protocol
Sep 22 17:55:48 nsdc-daffy.ad.home.mitos-kalandiel.me smbd[45]: [2018/09/22 17:55:48.443036,  0] ../source3/smbd/server.c:1093(smbd_open_one_socket)
Sep 22 17:55:48 nsdc-daffy.ad.home.mitos-kalandiel.me smbd[45]:   smbd_open_one_socket: open_socket_in: Address family not supported by protocol
Sep 22 17:55:50 nsdc-daffy.ad.home.mitos-kalandiel.me samba[37]: TLS self-signed keys generated OK
Sep 22 17:55:51 nsdc-daffy.ad.home.mitos-kalandiel.me samba[37]: ldapsrv failed to bind to :::389 - NT_STATUS_INVALID_PARAMETER_MIX
Sep 22 17:55:55 nsdc-daffy.ad.home.mitos-kalandiel.me systemd[1]: Starting Network Service...
Sep 22 17:55:55 nsdc-daffy.ad.home.mitos-kalandiel.me systemd-networkd[70]: host0           : Cannot configure IPv4 forwarding for interface host0: Read-only file system
Sep 22 17:55:55 nsdc-daffy.ad.home.mitos-kalandiel.me systemd-networkd[70]: host0           : Cannot configure IPv6 forwarding for interface: No such file or directory
Sep 22 17:55:55 nsdc-daffy.ad.home.mitos-kalandiel.me systemd-networkd[70]: Enumeration completed
Sep 22 17:55:55 nsdc-daffy.ad.home.mitos-kalandiel.me systemd-networkd[70]: host0           : host0           : could not bring up interface: Address family not supported by protocol
Sep 22 17:55:55 nsdc-daffy.ad.home.mitos-kalandiel.me systemd-networkd[70]: host0           : host0           : could not set route: Network is unreachable
Sep 22 17:55:55 nsdc-daffy.ad.home.mitos-kalandiel.me systemd-networkd[70]: host0           : link configured
Sep 22 17:55:55 nsdc-daffy.ad.home.mitos-kalandiel.me systemd[1]: Started Network Service.
Sep 22 18:05:46 nsdc-daffy.ad.home.mitos-kalandiel.me samba[37]: /usr/sbin/samba_dnsupdate: WARNING: no network interfaces found

ok to fix this

uninstall ad via gui

cli the following in termi

yum install samba-dc

rm -rf /var/lib/machines/nsdc

signal-event nethserver-sssd-remove-provider

reinstall ad in gui noting though if you dns domain name in the ad install shows

ad.domain.tld

and the top right of the gui it says something like

root@something.domain.tld

then in the ad install dns domain name type

something.ad.domainname.tld

this is how I got it to work with no errors

edited the example link to something that is not an actual domain…

so I’ve done as suggested, but still get the following:

Task completed with errors
S95nethserver-dc-waitstart #23 (exit status 256)
S96nethserver-dc-join #25 (exit status 256)
Adjust service sssd #203 (exit status 1)
    failed

I can’t see anything in /var/log/messages that indicates errors, but then again its full of shorewall events, since my NS is in a DMZ lol

/var/log/sssd/sssd.log however shows this:

(Tue Sep 25 09:32:46:885911 2018) [sssd] [sss_ini_get_config] (0x0010): Failed to parse configuration. Error 5.
(Tue Sep 25 09:32:46:886108 2018) [sssd] [sss_ini_get_config] (0x0010): Errors detected while parsing: /etc/sssd/sssd.conf
(Tue Sep 25 09:32:46:886202 2018) [sssd] [sss_ini_config_print_errors] (0x0010): Error (8) on line 1: Failed to read line.
(Tue Sep 25 09:32:46:886317 2018) [sssd] [confdb_ldif_from_ini_file] (0x0010): Failed to load configuration
(Tue Sep 25 09:32:46:886371 2018) [sssd] [confdb_init_db] (0x0020): Cannot convert INI to LDIF [5]: [Input/output error]
(Tue Sep 25 09:32:46:886445 2018) [sssd] [confdb_setup] (0x0010): ConfDB initialization has failed [5]: Input/output error
(Tue Sep 25 09:32:46:886537 2018) [sssd] [load_configuration] (0x0010): Unable to setup ConfDB [5]: Input/output error
(Tue Sep 25 09:32:46:886589 2018) [sssd] [main] (0x0020): SSSD couldn't load the configuration database.

Any other tips/tricks I can try to get back to a working state for my AD?

Ok yesterday night ad stopped working, so I deleted and tried again not installing again via my own method I must of missed something out in the method I wrote trying to go back to cli history but ive done mounting of things on the cli before and after I got it to work lmao

im gonna getting it working again today lmao and document everything as I go

Will post back when I find the solution again

Hey kirk, thanks a lot in advance, because to be quite frank this issue is getting on my bloody wick, lol

Make sure in your domain hosting company there is actually a subdomian for your ad mine is ad.webhost.dtjholdings.co.uk it takes around 20 mins for the dns to resolv so check top left in the gui

if it is

root@something.dtjholdings.tld

create a subdomain called

ad.something.dtjholdings.tld

i think this is a important because when ad installs it connects to the ad via external dns check so do not reinstall untill after 20 min just incase

oh i also removed opnvpn as it was throwing errors when i installed ad not sure if this was the problem as i never finished setting openvpn so i deleted just incase

Remove ad from gui

yum reinstall krb5-server krb5-libs

cli

rm /etc/krb5.conf.d/krb5.keytab

cli

rm /etc/krb5.keytab

delete everyfolder file in /var/kerberos/krb5kdc except kdc.conf do not delete kdc.conf

cli

expand-template /etc/samba/smb.conf

expand-template /etc/sssd/sssd.conf

ok onto installaling dc in gui

so if top left is

root@webhost.dtjholdings.co.uk

in dns domain name

ad.webhost.dtjholdings.co.uk

which should be the same as the subdomain you created with your domain name hoster.

This is how I just got it to re work again and im hoping it works for you lol

1 Like

Doing it now.

yum install output was as follows:

No Match for argument: krb5-server
Loading mirror speeds from cached hostfile
 * base: mirrors.vooservers.com
 * epel: mirrors.coreix.net
 * extras: mirrors.vooservers.com
 * nethforge: mirror.nordest.systems
 * nethserver-base: mirror.nordest.systems
 * nethserver-updates: mirror.nordest.systems
 * updates: mirrors.coreix.net
Package(s) krb5-server available, but not installed.

krb5-libs was installed successfully, however.

kdc.conf doesn’t exist at all…

any ideas?

yum install krb5-server

also reinstall samba-dc

yum reinstall samba-dc

if its not installed install that too

yum was successful, however still no krb5.keytab and after following the rest of your instructions I still get :

Task completed with errors
S95nethserver-dc-waitstart #23 (exit status 256)
S96nethserver-dc-join #25 (exit status 256)
Adjust service sssd #203 (exit status 1)
    failed

cat /var/log/sssd/sssd.log :

(Tue Sep 25 09:32:46:885911 2018) [sssd] [sss_ini_get_config] (0x0010): Failed to parse configuration. Error 5.
(Tue Sep 25 09:32:46:886108 2018) [sssd] [sss_ini_get_config] (0x0010): Errors detected while parsing: /etc/sssd/sssd.conf
(Tue Sep 25 09:32:46:886202 2018) [sssd] [sss_ini_config_print_errors] (0x0010): Error (8) on line 1: Failed to read line.
(Tue Sep 25 09:32:46:886317 2018) [sssd] [confdb_ldif_from_ini_file] (0x0010): Failed to load configuration
(Tue Sep 25 09:32:46:886371 2018) [sssd] [confdb_init_db] (0x0020): Cannot convert INI to LDIF [5]: [Input/output error]
(Tue Sep 25 09:32:46:886445 2018) [sssd] [confdb_setup] (0x0010): ConfDB initialization has failed [5]: Input/output error
(Tue Sep 25 09:32:46:886537 2018) [sssd] [load_configuration] (0x0010): Unable to setup ConfDB [5]: Input/output error
(Tue Sep 25 09:32:46:886589 2018) [sssd] [main] (0x0020): SSSD couldn't load the configuration database.
(Tue Sep 25 10:25:52:034388 2018) [sssd] [sss_ini_get_config] (0x0010): Failed to parse configuration. Error 5.
(Tue Sep 25 10:25:52:034556 2018) [sssd] [sss_ini_get_config] (0x0010): Errors detected while parsing: /etc/sssd/sssd.conf
(Tue Sep 25 10:25:52:034654 2018) [sssd] [sss_ini_config_print_errors] (0x0010): Error (8) on line 1: Failed to read line.
(Tue Sep 25 10:25:52:034721 2018) [sssd] [confdb_ldif_from_ini_file] (0x0010): Failed to load configuration
(Tue Sep 25 10:25:52:034778 2018) [sssd] [confdb_init_db] (0x0020): Cannot convert INI to LDIF [5]: [Input/output error]
(Tue Sep 25 10:25:52:034850 2018) [sssd] [confdb_setup] (0x0010): ConfDB initialization has failed [5]: Input/output error
(Tue Sep 25 10:25:52:034948 2018) [sssd] [load_configuration] (0x0010): Unable to setup ConfDB [5]: Input/output error
(Tue Sep 25 10:25:52:035003 2018) [sssd] [main] (0x0020): SSSD couldn't load the configuration database.
(Tue Sep 25 15:31:06:675858 2018) [sssd] [sss_ini_get_config] (0x0010): Failed to parse configuration. Error 5.
(Tue Sep 25 15:31:06:676031 2018) [sssd] [sss_ini_get_config] (0x0010): Errors detected while parsing: /etc/sssd/sssd.conf
(Tue Sep 25 15:31:06:676124 2018) [sssd] [sss_ini_config_print_errors] (0x0010): Error (8) on line 1: Failed to read line.
(Tue Sep 25 15:31:06:676189 2018) [sssd] [confdb_ldif_from_ini_file] (0x0010): Failed to load configuration
(Tue Sep 25 15:31:06:676292 2018) [sssd] [confdb_init_db] (0x0020): Cannot convert INI to LDIF [5]: [Input/output error]
(Tue Sep 25 15:31:06:676367 2018) [sssd] [confdb_setup] (0x0010): ConfDB initialization has failed [5]: Input/output error
(Tue Sep 25 15:31:06:676460 2018) [sssd] [load_configuration] (0x0010): Unable to setup ConfDB [5]: Input/output error
(Tue Sep 25 15:31:06:676516 2018) [sssd] [main] (0x0020): SSSD couldn't load the configuration database.

I really am at the end of my tether with this one, lol

try the expand templates again and restart smb and sssd

Then repeat all steps again but do not do the yum install parts again

Did it create any files in var/lib/verbose folder

Sorry kerbose

I’ll try that, and no such file or directory exists (verbose) in /var/log

systemctl restart sssd && journalctl -xe results in the following output:

Sep 25 15:51:26 daffy.home.mitos-kalandiel.me polkitd[966]: Registered Authentication Agent for unix-process:1260:27482803 (system bus name :1.2951 [/usr/bin/pkttyagent --notify-fd 5 -
Sep 25 15:51:26 daffy.home.mitos-kalandiel.me systemd[1]: Starting System Security Services Daemon...
-- Subject: Unit sssd.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit sssd.service has begun starting up.
Sep 25 15:51:26 daffy.home.mitos-kalandiel.me sssd[1266]: SSSD couldn't load the configuration database [5]: Input/output error.
Sep 25 15:51:26 daffy.home.mitos-kalandiel.me systemd[1]: sssd.service: main process exited, code=exited, status=4/NOPERMISSION
Sep 25 15:51:26 daffy.home.mitos-kalandiel.me systemd[1]: Failed to start System Security Services Daemon.
-- Subject: Unit sssd.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit sssd.service has failed.
--
-- The result is failed.
Sep 25 15:51:26 daffy.home.mitos-kalandiel.me systemd[1]: Unit sssd.service entered failed state.
Sep 25 15:51:26 daffy.home.mitos-kalandiel.me polkitd[966]: Unregistered Authentication Agent for unix-process:1260:27482803 (system bus name :1.2951, object path /org/freedesktop/Poli
Sep 25 15:51:26 daffy.home.mitos-kalandiel.me systemd[1]: sssd.service failed.