0

I have a EC2 instance called EC2-B and I configured it to use AD Connector.

This is instance is in the VPC B while the AD Connector EC2 is in VPC A.

I have another instance EC2-A in the VPC-A and did the configuration as in AWS manual https://docs.aws.amazon.com/directoryservice/latest/admin-guide/join_linux_instance.html#w129aab9c26c13c15b8b8b1

The instance EC2-A works fine with the configurations, it joined the AD and I can login it with AD login.

I did the same configurations in the instance EC2-B but is not working, it only gives me the message in sssd log Port status of port 0 for server 'domain.com' is 'not working'

I tested telnet with ports 389 and 88 and it works fine.

Here is my /etc/sssd/sssd.conf:

[sssd]
debug_level = 9
domains = DOMAIN.COM
config_file_version = 2
services = nss, pam

[domain/DOMAIN.COM]
debug_level = 9
ad_server = domain.com
ad_domain  = DOMAIN.COM
krb5_realm = DOMAIN.COM
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_sasl_authid = EC2-B$
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%u
access_provider = ad

And the /etc/krb5.conf:

includedir /etc/krb5.conf.d/

includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = true
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
 default_ccache_name = KEYRING:persistent:%{uid}

 default_realm = DOMAIN.COM
[realms]    
 DOMAIN.COM = {
   kdc = domain.com
   admin_server = domain.com
   default_domain = DOMAIN.COM
   rdns = false
 }

[domain_realm]
 domain.com = DOMAIN.COM
 .domain.com = DOMAIN.COM

Another problem is that I can test kinit without problem but the sssd that use the Kerberos configuration doesn't work:

kinit -V user
Using existing cache: persistent:0:0
Using principal: user@DOMAIN.COM
Password for user@DOMAIN.COM: 
Authenticated to Kerberos v5
Raul
  • 1
  • Did you configure peering between the two VPCs properly? Does the subnet route table contain a route for accessing the second VPC? – jordanm Feb 05 '20 at 21:05
  • Yes, I configured the access from VPC1 to VPC2 with a VPC Peering. – Raul Feb 06 '20 at 12:46

1 Answers1

0

The problem was solved on Server side.

It was not allowed to send informations back to instance EC2-B

Raul
  • 1