Red Hat Enterprise Linux Diagnostics and Troubleshooting

Instructions

The IdM server on the utility machine provides LDAP and Kerberos services for the lab.example.com domain. Users report that they cannot acquire a Ticket Granting Ticket (TGT) to access services. An administrator reports that the servera system was configured manually without using configuration management tools.

You are asked to locate the root cause and resolve this issue. When resolved, users on the servera system can acquire a TGT and use the ipa command to gather user information. Use RedHat123^ as the password.

1. Log in to the servera machine and re-create the issue.

   1. Log in to servera and switch to the root user.

      [student@workstation ~]$ ssh student@servera
      ...output omitted...
      [student@servera ~]$ sudo -i
      [sudo] password for student: student
      [root@servera ~]#

   2. Run the kinit admin command, with RedHat123^ as the password, to attempt to acquire a TGT for the admin user.

      [root@servera ~]# kinit admin
      kinit: Cannot contact any KDC for realm 'LAB.EXAMPLE.COM' while getting initial credentials

   Hide Solution

2. Investigate the issue to determine the root cause.

   1. Check the sssd service logs for any failed request messages.

      [root@servera ~]# grep failed /var/log/sssd/sssd_lab.example.com.log
      ...output omitted...
      (2021-11-27 17:57:06): [be[lab.example.com]] [resolv_discover_srv_done] (0x0040): SRV query failed [4]: Domain name not found
      (2021-11-27 17:57:09): [be[lab.example.com]] [sssd_async_connect_done] (0x0020): connect failed [113][No route to host].
      (2021-11-27 17:57:09): [be[lab.example.com]] [sssd_async_socket_init_done] (0x0020): sdap_async_sys_connect request failed: [113]: No route to host.
      (2021-11-27 17:57:09): [be[lab.example.com]] [sss_ldap_init_sys_connect_done] (0x0020): sssd_async_socket_init request failed: [113]: No route to host.
      (2021-11-27 17:57:09): [be[lab.example.com]] [sdap_sys_connect_done] (0x0020): sdap_async_connect_call request failed: [113]: No route to host.

   2. The utility system hosts the IdM service that provides the LAB.EXAMPLE.COM realm. Verify that a DNS record for the utility.lab.example.com system exists.

      The DNS record appears to be correct. The utility.lab.example.com server is assigned 172.25.250.17 as an IP address.

      [root@servera ~]# dig utility.lab.example.com
      ; <<>> DiG 9.11.26-RedHat-9.11.26-4.el8_4 <<>> utility.lab.example.com
      ;; global options: +cmd
      ;; Got answer:
      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40518
      ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
      
      ;; OPT PSEUDOSECTION:
      ; EDNS: version: 0, flags:; udp: 4096
      ;; QUESTION SECTION:
      ;utility.lab.example.com.	IN	A
      
      ;; ANSWER SECTION:
      utility.lab.example.com. 3600	IN	A	172.25.250.17
      
      ;; Query time: 1 msec
      ;; SERVER: 172.25.250.254#53(172.25.250.254)
      ;; WHEN: Sat Nov 27 18:14:43 EST 2021
      ;; MSG SIZE  rcvd: 68

   3. Verify that the network interface on the utility.lab.example.com system is active.

      The ping command attempts to access a 172.25.250.177 IP address, which is incorrect.

      [root@servera ~]# ping -c3 utility.lab.example.com
      PING utility.lab.example.com (172.25.250.177) 56(84) bytes of data.
      From servera.lab.example.com (172.25.250.10) icmp_seq=1 Destination Host Unreachable
      From servera.lab.example.com (172.25.250.10) icmp_seq=2 Destination Host Unreachable
      From servera.lab.example.com (172.25.250.10) icmp_seq=3 Destination Host Unreachable
      
      --- utility.lab.example.com ping statistics ---
      3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2024ms
      pipe 2

   4. View the /etc/hosts file on the servera machine for a possible conflicting record.

      It appears that the utility IP address record was manually entered incorrectly.

      [root@servera ~]# cat /etc/hosts
      ...output omitted...
      172.25.250.254 bastion.lab.example.com bastion
      172.25.250.9   workstation.lab.example.com workstation
      172.25.250.10  servera.lab.example.com servera
      172.25.250.11  serverb.lab.example.com serverb
      172.25.250.177  utility.lab.example.com utility

   Hide Solution

3. Resolve the issue and verify that the kinit and ipa commands work as expected. Use RedHat123^ as the password.

   1. Edit the /etc/hosts file to add 172.25.250.17 as the correct IP address for the utility.lab.example.com machine.

      The entry for the utility.lab.example.com machine should match the following output:

      [root@servera ~]# cat /etc/hosts
      ...output omitted...
      172.25.250.17  utility.lab.example.com utility

   2. Restart the sssd service.

      [root@servera ~]# systemctl restart sssd

   3. Run the kinit admin command, with RedHat123^ as the password, to acquire a TGT for the admin user.

      [root@servera ~]# kinit admin
      Password for admin@LAB.EXAMPLE.COM: RedHat123^

   4. Run the ipa user-find admin command to verify the admin user record in IdM.

      [root@servera ~]# ipa user-find admin
      --------------
      1 user matched
      --------------
        User login: admin
        Last name: Administrator
        Home directory: /home/admin
        Login shell: /bin/bash
        Principal alias: admin@LAB.EXAMPLE.COM, root@LAB.EXAMPLE.COM
        UID: 546600000
        GID: 546600000
        Account disabled: False
      ----------------------------
      Number of entries returned 1
      ----------------------------

   Hide Solution

4. Return to workstation as the student user.

   [root@servera ~]# exit
   [student@servera ~]$ exit
   [student@workstation ~]$

   Hide Solution