Re: [Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-08 Thread Martin (Lists)
Am 08.04.2015 um 10:27 schrieb Jakub Hrozek: Can you run: KRB5_TRACE=/dev/stderr kinit yourprinc@YOUR.REALM So that we can compare with the krb5_child.log you sent earlier? I wonder if SSSD talks to a KDC that is slower or far away from your client.. This is my trace from kinit: [2422]

Re: [Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-08 Thread Jakub Hrozek
On Wed, Apr 08, 2015 at 10:11:01AM +0200, Martin (Lists) wrote: Am 07.04.2015 um 18:27 schrieb Simo Sorce: On Tue, 2015-04-07 at 17:57 +0200, Martin (Lists) wrote: Hallo attached you can find the data from krb_child.log. As far as I can see it, the three seconds are due to the

Re: [Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-08 Thread Martin (Lists)
Am 08.04.2015 um 10:57 schrieb Jakub Hrozek: Most of the host can only communicate in the local net, which has not that much hosts (10). The wired ones are connected via GBit Network, wireless it is up to 150MBit. Server is a Xeon E3-1225 with 8GB Mem. All Systems have Fedora 21

Re: [Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-08 Thread Jakub Hrozek
On Wed, Apr 08, 2015 at 10:43:10AM +0200, Martin (Lists) wrote: Am 08.04.2015 um 10:27 schrieb Jakub Hrozek: Can you run: KRB5_TRACE=/dev/stderr kinit yourprinc@YOUR.REALM So that we can compare with the krb5_child.log you sent earlier? I wonder if SSSD talks to a KDC that is slower

Re: [Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-08 Thread Martin (Lists)
Am 07.04.2015 um 18:27 schrieb Simo Sorce: On Tue, 2015-04-07 at 17:57 +0200, Martin (Lists) wrote: Hallo attached you can find the data from krb_child.log. As far as I can see it, the three seconds are due to the communication with the kerberos server. (1.2.3.4 is my server). Do you

Re: [Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-07 Thread Jakub Hrozek
On Mon, Apr 06, 2015 at 08:01:46PM -0500, Dan Mossor wrote: On 04/05/2015 12:51 PM, Dmitri Pal wrote: On 04/05/2015 12:10 AM, Dan Mossor wrote: I've recently deployed a new domain based on 4.1.2 in F21. We've noticed an issue and can't quite seem to nail it down. The problem is that logins

Re: [Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-07 Thread Jakub Hrozek
On Tue, Apr 07, 2015 at 11:12:40AM +0200, Martin (Lists) wrote: Am 05.04.2015 um 11:51 schrieb Martin (Lists): Hallo I have a similar issue. On login (graphic systems and ssh) and on the screen saver I have a delay from about 2 secons to 10 seconds. According to my logfile i have

Re: [Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-07 Thread Martin (Lists)
Am 05.04.2015 um 11:51 schrieb Martin (Lists): Hallo I have a similar issue. On login (graphic systems and ssh) and on the screen saver I have a delay from about 2 secons to 10 seconds. According to my logfile i have the following timeline at login: 0 pam_unix (auth) 3

Re: [Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-07 Thread Jakub Hrozek
On Tue, Apr 07, 2015 at 05:57:49PM +0200, Martin (Lists) wrote: Hallo attached you can find the data from krb_child.log. As far as I can see it, the three seconds are due to the communication with the kerberos server. (1.2.3.4 is my server). regards Martin Yes. It looks like kinit takes

Re: [Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-07 Thread Simo Sorce
On Tue, 2015-04-07 at 17:57 +0200, Martin (Lists) wrote: Hallo attached you can find the data from krb_child.log. As far as I can see it, the three seconds are due to the communication with the kerberos server. (1.2.3.4 is my server). Do you experience the same latency if you kinit manually

Re: [Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-07 Thread Dan Mossor
On 04/07/2015 03:05 AM, Jakub Hrozek wrote: On Mon, Apr 06, 2015 at 08:01:46PM -0500, Dan Mossor wrote: On 04/05/2015 12:51 PM, Dmitri Pal wrote: Several tips. Please check your DNS configuration. Such delay is usually caused by the DNS lookups timing out. That means that the servers probably

Re: [Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-07 Thread Jakub Hrozek
On Tue, Apr 07, 2015 at 01:15:46PM -0500, Dan Mossor wrote: On 04/07/2015 03:05 AM, Jakub Hrozek wrote: On Mon, Apr 06, 2015 at 08:01:46PM -0500, Dan Mossor wrote: On 04/05/2015 12:51 PM, Dmitri Pal wrote: Several tips. Please check your DNS configuration. Such delay is usually caused by the

Re: [Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-06 Thread Dan Mossor
On 04/05/2015 12:51 PM, Dmitri Pal wrote: On 04/05/2015 12:10 AM, Dan Mossor wrote: I've recently deployed a new domain based on 4.1.2 in F21. We've noticed an issue and can't quite seem to nail it down. The problem is that logins are taking an inordinate amount of time to complete - the

Re: [Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-05 Thread John Obaterspok
Hi Dan, I had a problem that login time increased by ~ 15 seconds from F20 - F21. That was worked around by adding selinux_provider = none to the domain section in /etc/sssd/sssd.conf Have you checked that dns lookups + reverse lookups work on the ipa server? Is id -G the_user_name and is the

Re: [Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-05 Thread Martin (Lists)
Am 05.04.2015 um 06:10 schrieb Dan Mossor: I've recently deployed a new domain based on 4.1.2 in F21. We've noticed an issue and can't quite seem to nail it down. The problem is that logins are taking an inordinate amount of time to complete - the fastest logon we can get using LDAP

Re: [Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-05 Thread Dmitri Pal
On 04/05/2015 12:10 AM, Dan Mossor wrote: I've recently deployed a new domain based on 4.1.2 in F21. We've noticed an issue and can't quite seem to nail it down. The problem is that logins are taking an inordinate amount of time to complete - the fastest logon we can get using LDAP credentials

[Freeipa-users] Slow logins on FreeIPA 4.1.2 (F21)

2015-04-04 Thread Dan Mossor
I've recently deployed a new domain based on 4.1.2 in F21. We've noticed an issue and can't quite seem to nail it down. The problem is that logins are taking an inordinate amount of time to complete - the fastest logon we can get using LDAP credentials is 8 seconds. During our testing, even