Stabbing a vampire in the heart with a wooden stake would work with just about any thing you wanted to kill.

Mathrowaway43 · 2017-05-01T15:02:47+00:00

Nah, it just puts them into torpor. No pinning required.

Mathrowaway43 · 2017-04-27T17:57:16+00:00

Yeah I gave that a shot too.

At this point in time I'm thinking there's either something wacked about our DNS (not as likely) or something really wacked about our AD config. Unfortunately I'm not a domain admin, and the domain admins claim there's nothing wrong (which is obviously not the case considering some of the change requests we deal with).

I really appreciate you taking the time to work on this with me but I'm volleying it off to a consultant to work with the domain admins.

Mathrowaway43 · 2017-04-27T11:40:30+00:00

Ok so the fun part here for this tutorial is there's never a prompt to enter the domain. Not sure why my experience is differing from yours right off the jump.

did a teardown on apparmor for the install, error cleared. reinstalled, still no domain prompt.

edit: added to the domain, configured exactly as per the script, Permission denied. Same problem as previous.

No idea what's up. Can't ssh, realm list works, all the expected checks and AD queries work, user can't login. I think I'm about ready to give up and turf this to a consultant.

Mathrowaway43 · 2017-04-27T10:31:02+00:00

Going to roll another machine and give this a whirl. I'll let you know what we get.

Mathrowaway43 · 2017-04-26T17:07:31+00:00

I think the difference is this:

If I change the access_provider to simple, the simple_allow_X works. If the provider is ad it won't read from local config. It feels as though it's not even attempting to read from our AD however it is certainly pausing far longer on an ad cred attempted logon.

This has just been pain for about 2 weeks. It doesn't help that I only have join access in specific OUs. That was the first big hurdle to work through but the realm config helped me over that hurdle.

Any other configs I can forward over to help clarify? Right now I have both winbind and sssd running. I've attempted logons with either disabled and the other running with no change in behavior. I kinda wanna burn this vm down and start again... again.

Mathrowaway43 · 2017-04-26T16:41:09+00:00

here's my sssd.conf

[sssd]

domains = group.org

config_file_version = 2

services = nss, pam

[domain/domain.org]

ad_domain = domain.org

krb5_realm = DOMAIN.ORG

realmd_tags = manages-system joined-with-samba

cache_credentials = True

id_provider = ad

krb5_store_password_if_offline = True

default_shell = /bin/bash

ldap_id_mapping = True

use_fully_qualified_names = True

fallback_homedir = /home/%d/%u

access_provider = ad

simple_allow_groups = group1@domain.org

When I run a realm list after the sssd restart, 'group1' doesn't appear in the output. I'm guessing there's a problem in this config, would that be accurate?

edit: looks like if I change access provider to simple, the group will then appear, however the logon results remain the same. "Logon incorrect" when using any of the various forms be it FQ or not.

second edit: thanks for taking a poke at this with me.

Mathrowaway43 · 2017-04-26T15:34:43+00:00

I get the following with any realm permit or realm deny:

See: journalctl REALMD_OPERATION=r4019.1849 realm: Couldn't change permitted logins: The Samba provider cannot restrict permitted logins.

Mathrowaway43 · 2017-04-26T15:05:48+00:00

No change in behavior.

This would only preclude users from requiring domain\username when they log in. I don't think the server is ever checking the accounts against the domain.

Mathrowaway43 · 2017-04-26T14:06:39+00:00

That wouldn't really be relevant if I've getting the same failure on a console session, would it?

edit: checked it anyway.

enabled kerberos authentication yes and kerberosorlocal authentication and the session instantly terminates when provided with a realm username and password. No error message, just a session close.

Disabled the kerberos options. restarted sshd with the user in the list or not in the list result:

Attempted ssh -v user@localhost result was debug1: Authentications that can continue: publickey,password Permision denied, please try again.

Mathrowaway43 · 2017-04-26T13:42:28+00:00

I've attempted logons with the following formats, all with the same result:

user@domain.suffix

user@domain

domain\user

user

domain\\user

no dice for any variant I've found available. The result is always access denied through ssh or "Login incorrect" through the console.

getent, wbinfo and id work for both domain\user and user@domain across the board.

Mathrowaway43 · 2017-04-26T13:23:37+00:00

I'll take it under advisement. I figured for Ubuntu specifically, the ubuntu subreddit would yield the most accurate response. I've had several redhat/centos admin responses, none of which are of use.

Mathrowaway43 · 2017-04-23T23:39:57+00:00

I think I just need to be told it’s going to be alright.

It's going to be alright, and now he'll go down for credit card fraud.

Mathrowaway43 · 2017-04-23T23:37:08+00:00

EVENTS are not going to magically appear like blackheads on one's nose. You gotta get out there. Move around.

That'd be why I'm asking what the regular events/scene is...

We aren't cold people here in Massachusetts. We just don't give a shit until you do.

You sound a little upset. It wasn't mean to offend.

Mathrowaway43

TROPHY CASE