SSSD ldap error: Cannot contact any KDC

davidep · November 15, 2017, 5:08pm

There’s a fix for the restore-config procedure that prevents this from happen. However it’s really difficult to hit this bug in real world servers.

github.com/NethServer/dev

Cannot contact any KDC for realm (sssd)

opened 05:04PM - 14 Nov 17 UTC

closed 04:42PM - 24 Nov 17 UTC

DavidePrincipi

bug verified

Under some circumstances, the Samba DC container looses the krb5.conf file state… and samba DC fails to start the KDC services. The service seems to run but ports 88 (kerberos-sec) and 464 (kpasswd5) are closed and some services fail to authenticate correctly (say SSSD, account listings...). **Steps to reproduce** Real world: - Configure a local AD accounts provider - Create a config backup - Restore the config backup on a clean 7.4 - Update/Reinstall krb5-libs in nsdc container ```text yum --installroot=/var/lib/machines/nsdc reinstall krb5-libs ``` - Restart samba service in nsdc container ```text systemctl -M nsdc restart samba ``` Testing environment shortcut: - Configure a local AD accounts provider - Remove ``/var/lib/machines/nsdc/var/lib/samba/private/krb5.conf`` - Restart samba service in nsdc container - Get users list ``/usr/libexec/nethserver/list-users`` **Expected behavior** Get the list of users **Actual behavior** Error message: ```text (1) SASL:[GSSAPI]: Failed to start authentication backend: NT_STATUS_INTERNAL_ERROR at /usr/share/perl5/vendor_perl/NethServer/LdapClient.pm line 126. ``` In sssd journal ``journalctl -u sssd``: ```text Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Cannot contact any KDC for realm 'AD.DPNET.NETHESIS.IT'. Unable to create GSSAPI-encrypted LDAP connection. ``` In samba dc journal ``journalctl -M nsdc -u samba``: ```text task_server_terminate: [kdc: krb5_init_context failed] ``` **Components** nethserver-sssd-1.3.3-1.ns7.noarch nethserver-dc-1.3.1-1.ns7.x86_64 **See also** https://community.nethserver.org/t/sssd-ldap-error-cannot-contact-any-kdc/8204 ---- Thanks to @fasttech and André Wismer

Opened (and closed as “wontfix”) an issue here. It is tracked by an upstream bug; as said it can be ignored. More info here:

github.com/NethServer/dev

sssd: tkey query failed (dyndns_update)

opened 05:15PM - 14 Nov 17 UTC

closed 05:06PM - 15 Nov 17 UTC

DavidePrincipi

bug invalid

On a running NethServer 7.4 with local AD accounts provider an error message is …logged to the journal every day at the same hour. **Steps to reproduce** ```text journalctl -u sssd | grep 'tkey query' ``` **Expected behavior** No error in the journal **Actual behavior** The query matches the same error line in the same hour every day and when sssd is restarted **Components** nethserver-sssd-1.3.3-1.ns7.noarch nethserver-dc-1.3.1-1.ns7.x86_64 **See also** - upstream bug https://bugzilla.redhat.com/show_bug.cgi?id=1394320 - https://community.nethserver.org/t/sssd-ldap-error-cannot-contact-any-kdc/8204/14 ---- Thanks to @fasttech and André Wismer