AD unreachable, no secure connection

NethServer Version: NethServer 7.9.2009

Hello all,

This morning i cannot connect my Windows 10 pro to my Nethserver AD.
My session is open, i can ssh the nethserver or https to cockpit, but no access to any drives (gasp).

On windows side i have the message “your domain is not available”.

On Nethserver, I try to figure out a message in differents /var/log/…log files but i did not notice anything clear for me.
When i’m looking in Cockpit/user&groups/AD local i have a clear :

“STARTTLS Desactivé
Mot de passe Bind xxxxxxxxxxxxxxxxxx
Base DN dc=ad,dc=maison,dc=lan
Bind DN ldapservice@AD.MAISON.LAN
URI du serveur LDAP ldaps://nsdc-neth.ad.maison.lan
IP Active Directory 192.168.65.248
Utilisateur DN dc=ad,dc=maison,dc=lan
Groupe DN dc=ad,dc=maison,dc=lan”

But when see at use there is a “No users had been created” “create one” and i have to restart NSDC to make then appear and i have the error :
“Oct 13 14:29:12 neth sssd: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database.”

Now i can connect my windows but i would like to understand why nsdc didn’t start and where i can log it.

Any idea ?
Thanks
Rémy.

Does your Windows 10 have yesterday or today installed KB5006670? Windows 10 21H1.

Moreover i’ve read this…

ldaps://nsdc-neth.ad.maison.lan

Did you instructed your server to validate the certifcate for that domain?

  1. Nope, no 21H1.
  2. ? standard installation.

Last reboot of the server? Does it carries latest kernel? Should be…

#uname -r
3.10.0-1160.42.2.el7.x86_64

I think you can find some info at messages log or samba log.

Hi Michael,

The problem is that i do not see anything in logs except :

"Oct 13 08:13:59 neth systemd-nspawn: systemd 219 running in system mode. (+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 -SECCOMP +BLKID +ELFUTILS +KMOD +IDN)
Oct 13 08:13:59 neth systemd-nspawn: Detected virtualization systemd-nspawn.
Oct 13 08:13:59 neth systemd-nspawn: Detected architecture x86-64.
Oct 13 08:13:59 neth systemd-nspawn: Welcome to #033[0;31mCentOS Linux 7 (Core)#033[0m!
Oct 13 08:13:59 neth systemd-nspawn: Set hostname to <nsdc-neth.ad.maison.lan>.
bla … bla

Oct 13 08:14:03 neth systemd-nspawn: [#033[32m OK #033[0m] Started Update UTMP about System Runlevel Changes.
Oct 13 08:14:04 neth systemd-nspawn: CentOS Linux 7 (Core)
Oct 13 08:14:04 neth systemd-nspawn: Kernel 3.10.0-1160.42.2.el7.x86_64 on an x86_64"

That seems ok but the container hangs.
I’d got the same logs at 14:29 when i restated it, whithout hang, and i can then login.

It’s not the first time that i see nsdc hangging whithout messages in logs at reboot or cold start and i still not understand why. ???

Thanks anyway,
Rémy.

@dev_team
Where can @Remy look for errors of nsdc?

:slight_smile: Did you try to reboot the server?

If that does not work, the following commands might help to understand. Please paste their output:

ip addr show type veth

Also

ping $(config getprop nsdc IpAddress)

You need to yum install -y nmap (consider also removing it at the end)

nmap $(config getprop nsdc IpAddress)

There could be a race condition somewhere in systemd-nspawn network devices management. It makes some system fail nsdc startup on boot. In early NS7 versions it was quite common, then we mitigated the issue with workarounds, avoiding full start/stop cycles during updates, backup/restore etc.


A command to restart nsdc in this case could be

systemctl stop nsdc && sleep 10 && systemctl start nsdc
2 Likes

Hi Davide,

I have two physical differents servers with proxmox on it where i virtualyse Nethserver and others services (soho lab).
I had the same problem on both, with older 7.x version too (as you said).

So i will enquire on network side the next time this problem occur (i didn’t notice problematic conditions from now).

Is there a way to ssh to the container ? I tried now but “connection refused”.

Thanks,
Rémy. :slight_smile:

No sshd in the container. Instead for more info look at nethserver-dc — NethServer 7 documentation (section " Running commands in nsdc")

3 Likes

Cool,
Thank you Davide.

1 Like