[Authentication] Problems renewing machine account password in AD

Gordon Messmer gordon at dragonsdawn.net
Wed Jul 11 20:23:16 UTC 2018


We're seeing problems with some hosts which appears to be caused by the new ad_maximum_machine_account_password_age support in sssd (which notes that a recent adcli is required for this functionality).

For some hosts, there is one set of credentials in krb5.keytab, and AD indicates that the machine account password was changed 30 days after the timestamp on those credentials.  On other hosts, we see a second set of credentials,
30 days newer than the first set, whose timestamp matches AD's PasswordLastSet property for that host.  For the latter set, users report that authentication works some of the time.

It may be relevant that this is a large multi-site domain, and we've also found that some hosts have been set up with "ad_site" specified in sssd.conf, pointing at a site that is incorrect (in that it is not the closest site).

Both sssd and adcli are out of date on the hosts we're troubleshooting, but I don't see any bugzilla entries, mailing list topics, or release notes that indicate that this is a known problem that has been fixed.

Which components should I be looking at when diagnosing this problem further, and what log settings might be most useful as I'm hunting down the problem?



Symptoms for host1:

System keytab contains old credentials.

    [root at host1 ~]# klist -kt /etc/krb5.keytab
    Keytab name: FILE:/etc/krb5.keytab
    KVNO Timestamp           Principal
    ---- ------------------- ------------------------------------------------------
       4 05/04/2018 11:10:30 host/host1.domain.lan at DOMAIN.LAN
       4 05/04/2018 11:10:30 host/HOST1 at DOMAIN.LAN
       4 05/04/2018 11:10:30 host/host1.domain.lan at DOMAIN.LAN
       4 05/04/2018 11:10:30 host/HOST1 at DOMAIN.LAN
       4 05/04/2018 11:10:30 host/host1.domain.lan at DOMAIN.LAN
       4 05/04/2018 11:10:30 host/HOST1 at DOMAIN.LAN
       4 05/04/2018 11:10:30 host/host1.domain.lan at DOMAIN.LAN
       4 05/04/2018 11:10:30 host/HOST1 at DOMAIN.LAN
       4 05/04/2018 11:10:30 host/host1.domain.lan at DOMAIN.LAN
       4 05/04/2018 11:10:30 host/HOST1 at DOMAIN.LAN
       4 05/04/2018 11:10:30 HOST1$@DOMAIN.LAN
       4 05/04/2018 11:10:30 HOST1$@DOMAIN.LAN
       4 05/04/2018 11:10:30 HOST1$@DOMAIN.LAN
       4 05/04/2018 11:10:30 HOST1$@DOMAIN.LAN
       4 05/04/2018 11:10:30 HOST1$@DOMAIN.LAN

The date of the new credentials matches the “PasswordLastSet” property on that host in AD:

    PS H:\> Get-ADComputer -Identity host1 -Properties name,LastLogonDate,PasswordLastSet,modified,modifyTimeStamp

    DistinguishedName : CN=HOST1,OU=Build,OU=DOMAIN_DevIT,DC=domain,DC=lan
    DNSHostName       : host1.domain.lan
    Enabled           : True
    LastLogonDate     : 6/1/2018 10:41:59 AM
    Modified          : 6/3/2018 3:27:10 PM
    modifyTimeStamp   : 6/3/2018 3:27:10 PM
    Name              : HOST1
    ObjectClass       : computer
    ObjectGUID        : d21d7f72-xxxx-xxxx-xxxx-aac9cf895d31
    PasswordLastSet   : 6/3/2018 3:26:59 PM
    SamAccountName    : HOST1$
    SID               : S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxxxx
    UserPrincipalName :
    UserPrincipalName :

adcli and sssd are out of date on that host:

    [root at host1 ~]# rpm -q adcli sssd
    adcli-0.8.1-3.el7.x86_64
    sssd-1.15.2-50.el7_4.11.x86_64

The current versions are:

    $ yum list adcli sssd
    …
    Installed Packages
    sssd.x86_64                     1.16.0-19.el7                @base
    Available Packages
    adcli.x86_64                    0.8.1-4.el7                  base

Logs include:

    [sssd[ldap_child[1271]]]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Preauthentication failed. Unable to create GSSAPI-encrypted LDAP connection.
    [sssd[ldap_child[1271]]]: Preauthentication failed



Symptoms for host2:

System keytab contains new credentials, 30 days newer than a previous set.

    [it at host2 ~]$ sudo klist -kt /etc/krb5.keytab
    [sudo] password for it:
    Keytab name: FILE:/etc/krb5.keytab
    KVNO Timestamp           Principal
    ---- ------------------- ------------------------------------------------------
      3 05/21/2018 11:50:41 host/host2.domain.lan at DOMAIN.LAN
      3 05/21/2018 11:50:41 host/host2.domain.lan at DOMAIN.LAN
      3 05/21/2018 11:50:41 host/host2.domain.lan at DOMAIN.LAN
      3 05/21/2018 11:50:41 host/host2.domain.lan at DOMAIN.LAN
      3 05/21/2018 11:50:41 host/host2.domain.lan at DOMAIN.LAN
      3 05/21/2018 11:50:41 host/HOST2 at DOMAIN.LAN
      3 05/21/2018 11:50:41 host/HOST2 at DOMAIN.LAN
      3 05/21/2018 11:50:41 host/HOST2 at DOMAIN.LAN
      3 05/21/2018 11:50:41 host/HOST2 at DOMAIN.LAN
      3 05/21/2018 11:50:41 host/HOST2 at DOMAIN.LAN
      3 05/21/2018 11:50:41 HOST2$@DOMAIN.LAN
      3 05/21/2018 11:50:41 HOST2$@DOMAIN.LAN
      3 05/21/2018 11:50:41 HOST2$@DOMAIN.LAN
      3 05/21/2018 11:50:41 HOST2$@DOMAIN.LAN
      3 05/21/2018 11:50:41 HOST2$@DOMAIN.LAN
      4 06/21/2018 08:09:02 HOST2$@DOMAIN.LAN
      4 06/21/2018 08:09:02 HOST2$@DOMAIN.LAN
      4 06/21/2018 08:09:02 HOST2$@DOMAIN.LAN
      4 06/21/2018 08:09:02 HOST2$@DOMAIN.LAN
      4 06/21/2018 08:09:02 HOST2$@DOMAIN.LAN
      4 06/21/2018 08:09:02 host/host2.domain.lan at DOMAIN.LAN
      4 06/21/2018 08:09:02 host/host2.domain.lan at DOMAIN.LAN
      4 06/21/2018 08:09:02 host/host2.domain.lan at DOMAIN.LAN
      4 06/21/2018 08:09:02 host/host2.domain.lan at DOMAIN.LAN
      4 06/21/2018 08:09:02 host/host2.domain.lan at DOMAIN.LAN
      4 06/21/2018 08:09:02 host/HOST2 at DOMAIN.LAN
      4 06/21/2018 08:09:02 host/HOST2 at DOMAIN.LAN
      4 06/21/2018 08:09:02 host/HOST2 at DOMAIN.LAN
      4 06/21/2018 08:09:02 host/HOST2 at DOMAIN.LAN
      4 06/21/2018 08:09:02 host/HOST2 at DOMAIN.LAN


The date of the new credentials matches the “PasswordLastSet” property on that host in AD:

    PS H:\> Get-ADComputer -Identity host2 -Properties name,LastLogonDate,PasswordLastSet,modified,modifyTimeStamp

    DistinguishedName : CN=HOST2,OU=Build,OU=DOMAIN_DevIT,DC=domain,DC=lan
    DNSHostName       : host2.domain.lan
    Enabled           : True
    LastLogonDate     : 7/6/2018 10:51:11 PM
    Modified          : 7/6/2018 10:52:06 PM
    modifyTimeStamp   : 7/6/2018 10:52:06 PM
    Name              : HOST2
    ObjectClass       : computer
    ObjectGUID        : f70a3bab-xxxx-xxxx-xxxx-932457b18768
    PasswordLastSet   : 6/21/2018 8:09:02 AM
    SamAccountName    : HOST2$
    SID               : S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxxxx
    UserPrincipalName :

adcli and sssd are out of date on that host:

    [root at host2 ~]# rpm -q adcli sssd
    adcli-0.8.1-3.el7.x86_64
    sssd-1.14.0-43.el7_3.14.x86_64

The current versions are:

    $ yum list adcli sssd
    …
    Installed Packages
    sssd.x86_64                 1.16.0-19.el7           @base
    Available Packages
    adcli.x86_64                0.8.1-4.el7             base

Logs include:

    [sssd[krb5_child[21580]]]: Preauthentication failed

 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/authentication/attachments/20180711/0d85f4cd/attachment.html>


More information about the Authentication mailing list