Categories
Linux

SSSD – Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Preauthentication failed. Unable to create GSSAPI-encrypted LDAP connection.

Errors Seen

The message Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Preauthentication failed. Unable to create GSSAPI-encrypted LDAP connection. is seen in your syslog (/var/log/messages or similar).

The message [[sssd[ldap_child[PIDXX]]]] [ldap_child_get_tgt_sync] (0x0010): Failed to init credentials: Preauthentication failed is seen in /var/log/sssd/ldap_child.log.

Any domain-based logins fail with Authentication service cannot retrieve authentication info (using PAM).

Why

The krb5.keytab is most likely corrupt. This could be due to no disk space left when writing to it or other IO errors.

As any solutions to fix the keytab will try to actually read and try to fix the incorrect data, they will mostly fail as the file is too damaged.

Solution

There are many ways to recreate the krb5.keytab and they will differ depending on your setup. RESEARCH THIS BEFORE YOU GO AHEAD as you might have to recreate the entire server in the domain, depending on its function.

As we were using the keytab for normal sign-ins and nothing else, the best way for us was to recreate it all over.

Just rejoining the domain did not work as it attempted to write to the already available keytab, so we had to remove the krb5.keytab entirely and then join the domain again.

Test with using <code>id <adusername></code>.

Categories
Linux SUSE

SUSE – SSSD domain joining fails with error “Internal error” and “Details: host/port don’t match”

Errors Seen

Using yast2, when using the User Logon Management or User Logon and attempting to domain join, you will see an error like this:

file

Why

This error has been seen when moving from samba domain join to SSSD as well as changing domains.

It is due to the cache having different information that is not being overwritten when attempting to join with SSSD, most likely the kerberos keytabs, although where exactly it is getting the wrong information from is a guess.

Solution (kinda)

Clear the domain cache. This is done in yast2 in the User Logon Management or User Logon, depending on the version.

file

Sometimes, this does not seem to be enough and you will have to install SSSD separately instead of making yast2 do it once it needs to do it.

sudo zypper install sssd

Having said all this, I have seen the above not work in more than a few situations and coming back a few minutes/hours later and suddenly it works. It seems to be more a yast2 issues than something else, as it is part of the resolver/resolving of the domain.

Troubleshooting have let to nowhere.

Categories
Linux SUSE

SUSE, Fedora – Auditd rules does not seem to work

Errors Seen

None of the custom rules set in /etc/audit/rules.d/ seems to be accepted, despite being shown when running auditctl -l

This issue has been seen on SUSE Linux Enterprise Server (SLES) 15 SP2 and Fedora 22 and onward.

Why

A default rule set in /etc/audit/rules.d/audit.rules disables any rules using SYSCALL, which overrides any other rules set.

## This suppresses syscall auditing for all tasks started
## with this rule in effect.  Remove it if you need syscall
## auditing.
-a task,never

This was added to minimize logging of auditd.

Solution

Edit /etc/audit/rules.d/audit.rules and comment out -a task,never.

The entirety of the file should look like this, if no changes have been made:

## This suppresses syscall auditing for all tasks started
## with this rule in effect.  Remove it if you need syscall
## auditing.
#-a task,never
Categories
Linux

Auditd – WARNING – 32/64 bit syscall mismatch in line, you should specify an arch

Errors Seen

The following is seen in your syslog/messages log file upon start/restart of auditd:

augenrules[13977]: WARNING - 32/64 bit syscall mismatch in line 121, you should specify an arch

Why

According to the manpage for audit.rules

If you get a warning from auditctl saying, "32/64 bit syscall mismatch in line XX, you should specify an arch". This means that you specified a syscall rule on a bi-arch system where the syscall has a different syscall number for the 32 and 64 bit interfaces. This means that on one of those interfaces you are likely auditing the wrong syscall.

Solution

Divide the rule into 2, and adding the arch, for example:

-always,exit -S openat -k access`

becomes

-always,exit -F arch=b32 -S openat -k access
-always,exit -F arch=b64 -S openat -k access

Essentially adding -F arch=b32 and -F arch=b64. Notice that they need to be the very first argument set right after always,exit or similar.

Categories
Windows

Windows Terminal – ALT + Arrow Keys Not Working

Errors Seen

Using ALT + Any arrow key is not working in Windows Terminal, such as changing channel in Weechat, irssi and more.

Why

This is due to Windows Terminal using these keybinds for it’s own thing, in this case, to move focus.

Solution

Copy and paste the below into your settings.json (Accessed through the drop down menu and pressing Settings or CTRL + ,), in the "keybindings" section.

{ "command": { "action": "unbound", "direction": "down" }, "keys": "alt+down" },
{ "command": { "action": "unbound", "direction": "left" }, "keys": "alt+left" },
{ "command": { "action": "unbound", "direction": "right" }, "keys": "alt+right" },
{ "command": { "action": "unbound", "direction": "up" }, "keys": "alt+up" }
Categories
Last.fm

Last.fm – Radio Songs are Repeated

Errors Seen

Songs played on Spotify through Last.fm’s radio keeps repeating

Why

This is due to having repeat turned on.

Spotify keeps repeating the song and doesn’t "tell" Last.fm that the song is done, thus repeating it.

Solution

Simply press CTRL + R in Spotify to disable repeat or click the repeat button in the UI.

Categories
Games

Modern Warfare 2 Remastered Fails With “Out of Memory” Error

Errors Seen

Call of Duty: Modern Warfare 2 Campaign Remastered fails when launching with the error "Out of memory error. You are probably low on disk space. (12)"

This error also occurred in the previous game, Call of Duty: Modern Warfare Remastered.

Solution

  1. Download the players2 rar file.
  2. Extract it to the Call of Duty: Modern Warfare 2 Campaign Remastered folder (Can be found by pressing Options in the Battle.net Launcher and clicking Show in Explorer
  3. Go to your Battle.net Account and login, if not already
  4. Open up the developer tools in your browser (Usually by pressing F12)
  5. Go to Application -> Local Storage -> https://account.blizzard.com/ (Varies from browser to browser)
  6. Expand SessionInfo and find accountId. Copy it.
  7. Go into the players2 folder extracted in step 2.
  8. Rename the directory called accountId with the ID you copied in step 6.
  9. Start the game. Press No to starting it in safe mode as well as when prompted to reset settings.
  10. Enjoy!

Note, there are other ways to do this, such as restarting the computer in safe mode with networking, start the game and set it to windowed mode. The above approach is, however, easier and quicker to do.

Safe mode with networking also disables wifi, so it would not work unless you are cabled.

Categories
How To

letsencrypt – several domains in one certificate

Errors Seen

The errors found during this can be several, depending on setup. Going to the www.domain.com while you only have a certificate with domain.com, will make your browser complain about issues with the certificate.

Same with the other way around.

Why

The certificate needs to contain both the domains used in the VirtualHost in Apache or Server Block in nginx.

Solution

Run letsencrypt with

letsencrypt -d domain.com -d www.domain.com

Note that the above command will attempt to automatically add certificate to whichever webserver you are using. Use letsencrypt --help for further help.

Categories
How To

letsencrypt – The requested apache plugin does not appear to be installed

Errors Seen

  • The requested apache plugin does not appear to be installed
  • The requested nginx plugin does not appear to be installed
  • Certbot doesn’t know how to automatically configure the web server on this system. However, it can still get a certificate for you. Please run certbot certonly to do so. You’ll need to manually configure your web server to use the resulting certificate.

Solution

Install python3-certbot-apache or python3-certbot-nginx, depending on your error message and webserver

sudo apt install python3-certbot-apache

or

sudo apt install python3-certbot-nginx

The package name can be different depending on distro, the above is correct for Ubuntu and Debian.