1

Our Debian server somehow got disconnected from AD, and I am trying to get it back. I have tried different methods. The one that seems to have worked best is realm. Atleast it says that it has joined the realm. When I try to log in I get access denied. this is from /var/log/auth.log:

Aug 10 13:51:57 WD02 sshd[3876]: Received disconnect from 10.2.0.4: 13: Unable to authenticate [preauth] Aug 10 13:52:04 WD02 sshd[3878]: Invalid user **** from 10.2.0.4 Aug 10 13:52:04 WD02 sshd[3878]: input_userauth_request: invalid user ****[preauth] Aug 10 13:52:08 WD02 sshd[3878]: pam_krb5(sshd:auth): authentication failure; logname=**** uid=0 euid=0 tty=ssh ruser= rhost=10.2.0.4 Aug 10 13:52:08 WD02 sshd[3878]: pam_unix(sshd:auth): check pass; user unknown Aug 10 13:52:08 WD02 sshd[3878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.2.0.4 Aug 10 13:52:08 WD02 sshd[3878]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.2.0.4 user=ster Aug 10 13:52:08 WD02 sshd[3878]: pam_sss(sshd:auth): received for user ****: 10 (User not known to the underlying authentication module) Aug 10 13:52:10 WD02 sshd[3878]: Failed password for invalid user **** from 10.2.0.4 port 61928 ssh2

after i've been at this for a while it is now possible to login with the user i have experimented with, but only if I write the username ***@domain.name. This only works for this user however, everyone else gets denied, even if they login with @domain.name

Do anyone have any idea? I am not sure what config-files or other logs I should provide, but will happily do so if asked to.

Regards Stoffe Eriksson

Stoffe Eriksson
  • 21
  • 2

1 Answers1

0

Sounds like you need to rejoin the host to the domain. I use Samba instead of SSSD, but I think if you can translate this process it will work. All commandlines issued at the host, AD work is in Active Directory Users and Computers or PowerShell at an admin workstation or server with those roles.

  1. At the host, remove the host from the domain.
  2. Clear the Kerberos keytab.
  3. Ensure the host is removed from AD.
  4. Add the host to the domain.
  5. Ensure the correct location in AD.
  6. Recreate the keytab.

I use net ads leave -U <admin> where <admin> is the name of an AD account with domain joiner right.
Then net ads keytab flush -U <admin>, net ads join -U <admin>, net ads keytab create -U <admin.

Jeter-work
  • 845
  • 4
  • 15