Thanks Fabrice
result of ps -edf|grep winbindd
root 11584 1 0 May31 ? 00:00:09 /usr/sbin/winbindd --foreground
--no-process-group
root 11586 11584 0 May31 ? 00:00:12 /usr/sbin/winbindd --foreground
--no-process-group
root 16389 16369 0 15:32 pts/0 00:00:00 grep --color=auto winbindd
root 27261 1 0 Jun07 ? 00:00:04 winbindd-wrapper
root 27264 27261 0 Jun07 ? 00:00:00 sudo chroot /chroots/JBSAD
/usr/sbin/winbindd -s /etc/samba/JBSAD.conf -l /var/log/sambaJBSAD --foreground
root 27266 27264 0 Jun07 ? 00:00:01 /usr/sbin/winbindd -s
/etc/samba/JBSAD.conf -l /var/log/sambaJBSAD --foreground
root 27269 27266 0 Jun07 ? 00:00:02 /usr/sbin/winbindd -s
/etc/samba/JBSAD.conf -l /var/log/sambaJBSAD –foreground
[root@auqldrv00nac1ai ~]#
[root@auqldrv00nac1ai ~]# cd /usr/local/pf
[root@auqldrv00nac1ai pf]# chroot /chroots/JBSAD
bash-4.2# wbinfo -u
bash-4.2#
Yep, the second one works.
I shall remove the Computer from the Domain in and try again.
Thanks for your Help!!
Matthew
From: Durand fabrice [mailto:[email protected]]
Sent: Thursday, 7 June 2018 11:42 AM
To: Matthew Knott; [email protected]
Subject: Re: [PacketFence-users] Cant Connect to AD - Failed to join domain:
failed to connect to AD: Client not found in Kerberos database
Hello Matthew,
based on what i can see your server has been joined to the AD from the linux
system directly and not from the Admin gui.
What is the result of :
ps -edf|grep winbindd
And if you do exactly that:
fabian81:/usr/local/pf$ chroot /chroots/JBSAD
fabian81:/$ wbinfo -u
versus:
[root@auqldrv00nac1ai logs]# wbinfo -u
Which one works ?
If the 2nd one works than you need to remove the computer from the OU computers
in the AD and try to rejoin the domain from the admin gui.
Regards
Fabrice
Le 2018-06-06 à 20:36, Matthew Knott a écrit :
Hi Fabrice
Yep, I’m doing the wbinfo –u in /chroots/JBSAD/bin which
works.
Read through that Forum post (thanks for that) and tried using the FQDN, the
UPN and just the plain username.
Same result.
The account I’m trying to use to Join the Server to the main is the same one
that I tried on the Command line of the box, I.E.
[root@auqldrv00nac1ai logs]# ntlm_auth --username=mkxxxx.adm
Password:
NT_STATUS_OK: The operation completed successfully. (0x0)
Which, as you can see, also is successful. I checked AD Suers and Computers
and the Machine account Exists aswell ☺
Really Weird ☺
Matthew
Matthew Knott
IT Network & Security Administrator
E. [email protected]
T.
07 3810 2269
M.
0477733185
F.
07 3816 0535
JBS Australia
1 Lock Way, Riverview QLD 4303
P.O. Box 139 Booval Qld 4304
jbssa.com.au . LinkedIn
From: Fabrice Durand via PacketFence-users
[mailto:[email protected]]
Sent: Thursday, 7 June 2018 12:02 AM
To: [email protected]
Cc: Fabrice Durand
Subject: Re: [PacketFence-users] Cant Connect to AD - Failed to join domain:
failed to connect to AD: Client not found in Kerberos database
Hello Matthew,
are you doing wbinfo in the chroot ? (chroot /chroots/...)
Also (Error binding '80090308: LdapErr: DSID-0C0903D9, comment:
AcceptSecurityContext error, data 52e, v2580) looks to be an error related to
"Invalid credentials".
https://social.technet.microsoft.com/Forums/ie/en-US/474abb8f-cfc6-4cac-af79-c3e80e80291f/ldap-authentication-error-ldap-error-code-49-80090308-ldaperr-dsid0c090334-comment?forum=winserverDS
Regards
Fabrice
Le 2018-06-05 à 01:50, Matthew Knott via PacketFence-users a écrit :
Hi,
Hoping someone can help be with this Error.
When trying to Connect to a Windows 2008R2 Level Domain, I receive this Error
in the Web GUI.
Failed to join domain: failed to connect to AD: Client not found in Kerberos
database
And can see the Following in the Packetfence.log
Jun 5 05:32:48 auqldrv00nac1ai packetfence_httpd.aaa: httpd.aaa(13719) INFO:
[mac:00:04:f2:86:1e:a6] Password validation failed for cisco: passwords don't
match (pf::password::validate_password)
Jun 5 05:32:48 auqldrv00nac1ai packetfence_httpd.aaa: httpd.aaa(13719) ERROR:
[mac:00:04:f2:86:1e:a6] Error binding '80090308: LdapErr: DSID-0C0903D9,
comment: AcceptSecurityContext error, data 52e, v2580
Jun 5 05:32:48 auqldrv00nac1ai packetfence_httpd.aaa: httpd.aaa(13719) WARN:
[mac:00:04:f2:86:1e:a6] [JBSAD] Unable to connect to ldap.jbssa.com.au
(pf::Authentication::Source::LDAPSource::_connect)
Jun 5 05:32:48 auqldrv00nac1ai packetfence_httpd.aaa: httpd.aaa(13719) ERROR:
[mac:00:04:f2:86:1e:a6] [JBSAD] Unable to connect to any LDAP server
(pf::Authentication::Source::LDAPSource::_connect)
Jun 5 05:32:48 auqldrv00nac1ai packetfence_httpd.aaa: httpd.aaa(13719) ERROR:
[mac:00:04:f2:86:1e:a6] unable to read password file
'/usr/local/pf/conf/admin.conf'
(pf::Authentication::Source::HtpasswdSource::authenticate)
Looking in the log.winbind file in /chroots/JBXAD/var/log/sambaJBXAD I can see
the Following
[2018/05/31 06:22:43.266435, 0] ../lib/util/become_daemon.c:124(daemon_ready)
STATUS=daemon 'winbindd' finished starting up and ready to serve connections
[2018/05/31 06:22:43.409235, 0]
../source3/librpc/crypto/gse.c:214(gse_context_init)
Failed to initialize kerberos context! (Included profile directory could not
be read)
[2018/05/31 22:23:12.606100, 0]
../source3/winbindd/winbindd.c:281(winbindd_sig_term_handler)
Got sig[15] terminate (is_parent=0)
[2018/05/31 22:23:12.607356, 0]
../source3/winbindd/winbindd.c:281(winbindd_sig_term_handler)
Got sig[15] terminate (is_parent=1)
Wbinfo –u returns a list of users
ntlm_auth --username=mkxxxx.adm
Password:
NT_STATUS_OK: The operation completed successfully. (0x0)
Also Works.
NTP is in Sync
Yet I still can’t perform 802.1x Auth nor can I Use AD as a Authentication
Source.
Anyone have any Idea’s????
Thanks
In advance
Matthew
Matthew Knott
IT Network & Security Administrator
E. [email protected]
T.
07 3810 2269
M.
0477733185
F.
07 3816 0535
JBS Australia
1 Lock Way, Riverview QLD 4303
P.O. Box 139 Booval Qld 4304
jbssa.com.au . LinkedIn
________________________________________
Important Notice:
The contents of this electronic message and any attachments are intended only
for the addressee and may contain legally privileged or confidential
information. They may be only used for the purposes for which they were
supplied. If you are not the addressee, you are notified that any transmission,
distribution, downloading, printing or photocopying of the contents of this
message or attachments is strictly prohibited. Any privilege and/or
confidentiality attached to this message and attachments is not waived, lost or
destroyed by reason of mistaken delivery to you. If you have received this
message in error you should notify the sender by return e-mail or telephone +61
7 3810 2100, and destroy all copies of the message and any attachments.
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
--
Fabrice Durand
[email protected] :: +1.514.447.4918 (x135) ::
www.inverse.ca<http://www.inverse.ca>
Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence
(http://packetfence.org)
________________________________________
Important Notice:
The contents of this electronic message and any attachments are intended only
for the addressee and may contain legally privileged or confidential
information. They may be only used for the purposes for which they were
supplied. If you are not the addressee, you are notified that any transmission,
distribution, downloading, printing or photocopying of the contents of this
message or attachments is strictly prohibited. Any privilege and/or
confidentiality attached to this message and attachments is not waived, lost or
destroyed by reason of mistaken delivery to you. If you have received this
message in error you should notify the sender by return e-mail or telephone +61
7 3810 2100, and destroy all copies of the message and any attachments.
Matthew Knott
IT Network & Security Administrator
E. [email protected]<mailto:[email protected]>
[JBS Australia]<http://www.jbssa.com.au/>
T. 07 3810 2269
M. 0477733185
F. 07 3816 0535
JBS Australia
1 Lock Way, Riverview QLD 4303
P.O. Box 139 Booval Qld 4304
jbssa.com.au<http://www.jbssa.com.au/> .
LinkedIn<https://www.linkedin.com/company/jbs-australia>
________________________________
Important Notice:
The contents of this electronic message and any attachments are intended only
for the addressee and may contain legally privileged or confidential
information. They may be only used for the purposes for which they were
supplied. If you are not the addressee, you are notified that any transmission,
distribution, downloading, printing or photocopying of the contents of this
message or attachments is strictly prohibited. Any privilege and/or
confidentiality attached to this message and attachments is not waived, lost or
destroyed by reason of mistaken delivery to you. If you have received this
message in error you should notify the sender by return e-mail or telephone +61
7 3810 2100, and destroy all copies of the message and any attachments.
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
