I am new here, so please advise me, if I did miss something about the rules here.
We are running a network of computers in a Windows Server 2016 AD domain.
In Ubuntu 16.04 we configured Ubuntu to allow for domain users to login via Kerberos and SSSD. A CIFS share is mounted at login as well via pam_mount.
This works flawlessly in Ubuntu 16.04. With the same smb.conf, sssd.conf and pam_mount.conf.xml in Ubuntu 17.10 however, login sometimes works and sometimes does not! Both via GUI and command line, as well as ssh.
It is really frustrating to pinpoint the error, as it does not occur regularly and login with AD credentials sometimes does work!
From what I was able to gather from the side of the DC, when Login on the Ubuntu 17.10 client fails, no kerberos ticket was requested by the client from the DC.
As I am not too familiar with SSSD, Kerberos and PAM, I was wondering, whether I was missing out on some new developments in these packages that make additional configuration necessary?
Where could I start to pinpoint the problem?
The error in the sssd_pam.log is:
(Thu Nov 2 18:57:00 2017) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0
(Thu Nov 2 18:57:00 2017) [sssd[pam]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x5653aba02710:3:[email protected]@domain.name]
(Thu Nov 2 18:57:00 2017) [sssd[pam]] [sbus_remove_timeout] (0x2000): 0x5653abdb83b0
(Thu Nov 2 18:57:00 2017) [sssd[pam]] [pam_dp_process_reply] (0x0200): received: [4 (System error)][domain.name]
The sssd.conf looks like this:
[sssd]
config_file_version = 2
services = nss,pam
domains = domain.name
[nss]
[pam]
debug_level = 8
[domain/domain.name]
debug_level = 8
id_provider = ad
access_provider = ad
auth_provider = ad
enumerate = true
cache_credentials = false
case_sensitive = false
override_homedir = /home/%u
default_shell = /bin/bash
create_homedir = true
remove_homedir = true
krb5.conf like this:
[libdefaults]
default_realm = DOMAIN.NAME
ticket_lifetime = 24h
renew_lifetime = 7d
[realms]
CYANOLAB = {
kdc = server1.domain.name
kdc = server2.domain.name
admin_server = server1.domain.name
}
And smb.conf like this:
[global]
workgroup = DOMAIN
client signing = yes
client use spnego = yes
realm = domain.name
security = ads
kerberos method = secrets and keytab
What I tried so far:
- Enabled
cache_credentials
in the SSSD Configuration. - Reinstalled the entire system.
- Fiddled with the common-* files.
- Restarted all services (smbd,sssd, networking) manually.
All to no success.
I would really, really appreciate any tips, that could point me in the right direction to solving this mysterious (at least to me) problem.