jgauthier wrote: ↑2019/10/28 14:32:23
# realm join XXXX.XXXX.EDU -U xxxxxx
realm: Cannot join this realm
So it looks like the realm is not configured and I cannot join it because I am not an AD admin user. Do I have to ask my IT people to give me AD admin rights? I never had to do this before despite I installed several OS on so many machines (SL6, Centos 7, Unbutu, etc.).
jgauthier wrote: ↑2019/10/24 22:20:03
The ldap works just fine and people are able to login with their AD credentials with ssh. The autofs also works perfectly and kinit command has no problem to authenticate people.
The problem is that neither sudo -i or local login (I mean login directly on the physical computer) works with AD credentials. It's like only ssh is able to use the kerberos authentication. When I try to sudo -i I get those messages in /var/log/secure:
....
Is there any obvious reason why local authentication doesn't work with kerberos? I can post any other config file you may need to help me to resolve this problem. Thank you for your help!
Just to make sure,
Although it seems like you cannot join the domain with the 'realm' command, users are able to log into the machine with ssh?
One part of me wants to compare the /etc/pam.d/sshd and /etc/pam.d/system-auth. If you are able to log in over ssh, you SHOULD be able to log in locally.
For the not finding the domain, I tend to lean towards /etc/resolv.conf and seeing that you can 'nslookup <domain>' and see the correct DCs. However, being able to log in with credentials over ssh and seeing the DC when you do 'realm discover <domain>' takes me away from this. (I bring up resolv.conf because I had issues with NetworkManager resetting it all the time, which broke shares, etc) I'm still getting hung up on the issue with not being able to join the realm.
Try this: While logged into the box from one terminal, 'tail -F /var/log/secure' and try logging in with AD credentials both locally and through another ssh terminal session. Compare the output and maybe we can get a glimpse of what is working for one and not the other.
Let me know what you are thinking and I'll spin up some test machines.