Solved

SLES 9.3 authentication against AD 2008

Posted on 2009-05-19
10
1,032 Views
Last Modified: 2013-12-05
Morning,

A while back i asked a question about SLES 9.3 authentication against AD 2003 to which i got the following solution, which worked perfectly.

http://lists.suse.com/archive/suse-sles-e/2006-May/0049.html

My question is  this, Our windows AD has been upgraded to AD 2008 and now i can not authenticate against it and i am getting the following message in my messages file.

May 19 10:40:57 bmail1 winbindd[9794]: [2009/05/19 10:40:57, 0] libads/kerberos.c:ads_kinit_password(147)
May 19 10:40:57 bmail1 winbindd[9794]:   kerberos_kinit_password host/BMAIL1@AFRICANBANK.NET failed: Client not found in Ke
beros database
May 19 10:41:11 bmail1 winbindd[9794]: [2009/05/19 10:41:11, 0] libads/kerberos.c:ads_kinit_password(147)
May 19 10:41:11 bmail1 winbindd[9794]:   kerberos_kinit_password host/BMAIL1@AFRICANBANK.NET failed: Client not found in Ke
beros database
May 19 10:41:23 bmail1 winbindd[9794]: [2009/05/19 10:41:23, 0] libads/kerberos.c:ads_kinit_password(147)
May 19 10:41:23 bmail1 winbindd[9794]:   kerberos_kinit_password host/BMAIL1@AFRICANBANK.NET failed: Client not found in Ke
beros database
May 19 10:41:37 bmail1 winbindd[9794]: [2009/05/19 10:41:37, 0] libads/kerberos.c:ads_kinit_password(147)
May 19 10:41:37 bmail1 winbindd[9794]:   kerberos_kinit_password host/BMAIL1@AFRICANBANK.NET failed: Client not found in Ke
beros database

How can i resolve this?

Kind regards
Wesley
0
Comment
Question by:ablsysadmin
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 2
  • 2
  • +1
10 Comments
 
LVL 14

Accepted Solution

by:
Monis Monther earned 500 total points
ID: 24420505
I have revently joined a CentOS 5.2 to AD 2008 successfully (after pulling some hair out), but successfully, so

Client not found in kerberos databae means that you cant authinticate with kerberos, we can try a few steps here.

first update your samba packages.

now try kinit administrator
you should get promted for the password

when entering you password you should get back to the prompt and you can do
klist
this will list your ticket.

let me know if you pass this test , there are many things to consider here

0
 
LVL 7

Expert Comment

by:askb
ID: 24422076
Couple of things you can check:

1. Check  if you are useing the correct password of reset the password on AD side and try the same. (http://www.3sp.com/en/kb/idx.php/75/211/Active-Directory/article/Common-Active-Directory-Errors.html )
2. Check if the user/principal names exist on AD side.
0
 

Author Comment

by:ablsysadmin
ID: 24422369
ok, did the klist and this is result:

bmail1:~ # klist
Credentials cache: FILE:/tmp/krb5cc_0
        Principal: adadmin@%domain name%

  Issued           Expires          Principal
May 19 10:29:19  May 19 20:29:18  krbtgt/%domain name%@%domain name%
0
NEW Veeam Agent for Microsoft Windows

Backup and recover physical and cloud-based servers and workstations, as well as endpoint devices that belong to remote users. Avoid downtime and data loss quickly and easily for Windows-based physical or public cloud-based workloads!

 
LVL 5

Expert Comment

by:random_ru
ID: 24422792
Wesley,

What was the server OS  you upgraded from?
0
 
LVL 7

Expert Comment

by:askb
ID: 24423502
The client not foud is for - host/BMAIL1@AFRICANBANK.NET. You could try doing a kinit for this principal asswell ?
0
 
LVL 14

Expert Comment

by:Monis Monther
ID: 24424395
Do kinit alone with no arguments it should ask you for the administrator password, type the password and see what you get
0
 

Author Comment

by:ablsysadmin
ID: 24428736
Morning experts,

Ok, answers to your questions.

1. We upgraded our AD server from 2003 to 2008 (Microsoft)
2. BMAIL1 is the actual SLES 9.3 server, it is not a user.  Therefore there is no password to give when i do a kinit.
3. If i do a kinit alone i get the following.

bmail1:~ # kinit
adadmin@AFRICANBANK.NET's Password:
kinit: NOTICE: ticket renewable lifetime is 10 hours

In the first post it was said that i should update my samba packages.  I have not yet done this.  should i upgrade the server to SLES 10.2?  this will upgrade the samba packages.
0
 

Author Comment

by:ablsysadmin
ID: 24428755
Here is some more output when trying to log in with my domain account.

May 20 07:09:18 bmail1 winbindd[4300]: [2009/05/20 07:09:18, 0] libads/kerberos.c:ads_kinit_password(147)
May 20 07:09:18 bmail1 winbindd[4300]:   kerberos_kinit_password host/BMAIL1@AFRICANBANK.NET failed: Client not found in Kerberos database
May 20 07:09:18 bmail1 sshd[6142]: Invalid user wcoleman from 10.30.132.232
May 20 07:09:24 bmail1 pam_winbind[6144]: request failed: NT code 0xc0000388, PAM error was 4, NT error was NT code 0xc0000388
May 20 07:09:24 bmail1 pam_winbind[6144]: internal module error (retval = 4, user = `wcoleman')
May 20 07:09:24 bmail1 sshd[6144]: pam_krb5: unable to determine uid/gid for user
May 20 07:09:24 bmail1 sshd[6144]: pam_krb5: authentication fails for `wcoleman'
May 20 07:09:24 bmail1 sshd[6144]: pam_krb5: pam_sm_authenticate returning 10 (User not known to the underlying authentication module)
0
 

Author Comment

by:ablsysadmin
ID: 24429036
Hi guys,

i've been going through the questions i posted with the original setup. the problem there was with winbind, because it was not started.

bmail1:/ # wbinfo -u
Error looking up domain users
bmail1:/ # wbinfo -g
Error looking up domain groups

i am getting the same errors now, however, winbind is started.

I'm going to upgrade the server to SLES 10.2 and go through the configs as stated in this link.

http://lists.suse.com/archive/suse-sles-e/2006-May/0049.html

Hopefully with the updated packages (smb, winbind etc) the authentication will work.  If someone has steps on how to setup AD authentication between MS AD 2008 and SLES 10.2, that would be great.
0
 

Author Closing Comment

by:ablsysadmin
ID: 31582908
I upgraded the OS to SLES 10, still no joy.  Then upgraded the samba to 3.4, that did the job.  There was also a hot fix installed on the 2008 AD for kerberos authentication.  Not sure if that did anything. http://support.microsoft.com/kb/951191  Thanks
0

Featured Post

Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Unable to access folder shares on Netapp 1 23
leap year shell script 10 50
Linux 6 32
Server 2012 Active Directory Logging 7 11
In the first part of this tutorial we will cover the prerequisites for installing SQL Server vNext on Linux.
Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question