All of a sudden, new users cannot ssh into our ubuntu servers. When attempting, the connection will just close. I tried doing an su with my test user who has never logged into the server before and I get a permission denied. When I do a sudo service sssd status I get
jordend@server:/etc/ssh$ sudo service sssd status
● sssd.service - System Security Services Daemon
Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled)
Active: active (running) since Wed 2020-06-10 09:11:07 PDT; 10min ago
Main PID: 1090 (sssd)
Tasks: 4 (limit: 7065)
CGroup: /system.slice/sssd.service
├─1090 /usr/sbin/sssd -i --logger=files
├─1435 /usr/lib/x86_64-linux-gnu/sssd/sssd_be --domain mydomain.com --uid 0 --gid 0 --logger=files
├─1519 /usr/lib/x86_64-linux-gnu/sssd/sssd_nss --uid 0 --gid 0 --logger=files
└─1520 /usr/lib/x86_64-linux-gnu/sssd/sssd_pam --uid 0 --gid 0 --logger=files
Jun 10 09:11:06 server.mydomain.com sssd[be[1435]: Starting up
Jun 10 09:11:07 server.mydomain.com sssd[1520]: Starting up
Jun 10 09:11:07 server.mydomain.com sssd[1519]: Starting up
Jun 10 09:11:07 server.mydomain.com systemd[1]: Started System Security Services Daemon.
Jun 10 09:11:08 server.mydomain.com sssd[1090]: ; TSIG error with server: tsig verify failure
Jun 10 09:11:08 server.mydomain.com sssd[1090]: ; TSIG error with server: tsig verify failure
Jun 10 09:11:08 server.mydomain.com sssd[1090]: ; TSIG error with server: tsig verify failure
Jun 10 09:11:08 server.mydomain.com sssd[1090]: ; TSIG error with server: tsig verify failure
Jun 10 09:11:08 server.mydomain.com sssd[1090]: ; TSIG error with server: tsig verify failure
Jun 10 09:12:21 server.mydomain.com [sssd[krb5_child[2094]: No credentials cache found (filename: /tmp/krb5cc_600010461_Z13abW)
This appears to have happened on all 3 of my ubuntu servers.
It's a windows domain
[sssd]
domains = molienergy.com
config_file_version = 2
services = nss, pam
[domain/molienergy.com]
ad_domain = molienergy.com
krb5_realm = MOLIENERGY.COM
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = false
fallback_homedir = /home/%u@%d
access_provider = simple
simple_allow_groups = domain admins
I should also note that I can't simply just su as the user. I can do a sudo su username though.
