Keep in mind, if you use SSSD with my packages, you MUST recompile SSSD
Most quickest way is. (enable the sources lines in /etc/apt/sources.list
(* Optional newer SSSD )
echo "deb-src http://ftp.nl.debian.org/debian sid main contrib
non-free" > /etc/apt/sources.list.d/sid.list
(* buster only as far i know. )
apt-get install -t $(lsb_release -sc)-backports debhelper lintian devscripts
build-essential fakeroot dh-systemd libdistro-info-perl quilt -y
(buster + bullseye )
apt-get build-dep sssd -y
apt-get source sssd -by
With winbind, this is all you need.
# How you can use kerberos (man smb.conf search : kerberos method )
# This is "MY/Louis" preffered method on Member servers.
kerberos method = secrets and keytab
dedicated keytab file = /etc/krb5.keytab
# Renew the kerberos ticket or you member its computer password will expire.
winbind refresh tickets = yes
Greetz,
Louis
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens
> Patrick Goetz via samba
> Verzonden: dinsdag 2 november 2021 15:21
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] potential machine account expiry question
>
> Hi -
>
> I can't speak to this from the perspective of winbind, but
> this has been
> a chronic problem with sssd (for myself, and others), so I've
> run into a
> similar issue many times.
>
> Once the kerberos ticket for a machine expires, it can't rejoin the
> domain without manual intervention. Not sure where you read these
> tickets don't expire, but they do. Try running
>
> klist -kt
>
> to see ticket timestamps.
>
> At least in your case it's obvious why the ticket expired. sssd is
> supposed to be renewing the kerberos ticket automatically, but it
> doesn't always work for still unknown reasons. My solution to
> this for
> sssd is to run a cron job every night:
>
> 00 12 * * 1 root msktutil --update --computer-name cns-cryo-krak7
> --verbose --server austin.utexas.edu
>
> That appears to have resolved the issue.
>
> Again, your situation is more obvious, and since I haven't seen any
> reports of winbind having a similar problem, I'm hoping to
> not have to
> deal with this for my windbind-only installs. <:)
>
> On 11/2/21 08:49, Jason Keltz via samba wrote:
> > Hi.
> >
> > I'm dealing with an interesting problem - potentially a
> machine account
> > expiry issue in Samba AD (Samba 4.14.8).
> >
> > We have multiple Linux computer labs of machines joined to
> AD (running
> > Winbind).? Two labs of machines have been off for a few
> months.? When
> > turned back on, none of those machines appear to be joined to the
> > domain.? They were all working fine before.? Other machines have
> > remained on since they were joined to the domain, and they
> continue to
> > function perfectly.
> >
> > I can report the following:
> >
> > 1) winbind is running on all the hosts, and I don't see any
> specific
> > errors on either the client or the server.
> >
> > 2) wbinfo -u and wbinfo -g still work (does the client have
> to be joined
> > to the domain for this to work?), yet getent passwd <user>
returns
> > nothing (/etc/nsswitch.conf is the same as on a working
> machine with
> > "passwd: files winbind", and "group: files
winbind".
> >
> > 3) wbinfo -t says "checking the trust secret for domain
> EECSYORKUCA via
> > RPC calls succeeded", wbinfo -m reports BUILTIN, the host
> name, and the
> > domain name, and wbinfo --online-status reports active
> connection for
> > BUILTIN, the hostname, and the domain name.
> >
> > 4)? if I rejoin one of these AD clients to the domain, then
> it works
> > fine without changing any configuration files at all, and
> continues to
> > work after a reboot.
> >
> > 5) Although information online is very sporadic about this
> particular
> > issue, the general consensus seems to be (at least for
> WIndows clients)
> > that an AD client which is off will never be automatically
> "expired"? by
> > the server after any amount of time. For Windows, there is
> a default
> > timeout of 30 days, then the *client* should change the workstation
> > account password itself when it comes online next whether
> that's in a
> > month or a year.
> >
> > 6) I see samba has the "machine password timeout" option.?
> I don't set
> > it in my smb.conf, so I assume that the the default of 1
> week will be in
> > effect.? It's not clear what happens if this value is far
> exceeded. This
> > may be the WIndows equivalent of the 30 day password
> change. However, I
> > imagine that when the client comes online and winbind sees
> that it is
> > far longer than 1 week, it probably should change the
> account password
> > in coordination with the AD server.? I don't think the
> account would be
> > disabled.
> >
> > 7) I reviewed pwdLastSet available via "samba-tool show
HOST".? I
> > compared the result of pwdLastSet on two hosts that were
> joined to the
> > domain at approximately same time (same day, a few minutes
> apart) - one
> > that has remained on, and the other that has remained off.?
> pwdLastSet
> > on both of them is the time they were joined to the domain.
> Why would
> > the one that remained on not have pwdLastSet updated if winbind is
> > changing the account password weekly?
> >
> > 8) The clocks on the AD server and clients are in sync.
> >
> > Any suggestions on what I might run to debug this issue would be
> > appreciated.? I have many hosts that I can try on, though
> eventually I
> > will have to rejoin them to the domain.
> >
> > Jason.
> >
> >
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba
>
>