12 April,16 at 11:11 AM
Applies to: Centrify DirectControl 5.0.5 or below on RedHat 6.2
Problem:
In Active Directory Users and Computers console, Account options "Do not require Kerberos Preauthentication" is checked in user's profile.
Attempting to ssh into a RedHat 6.2 serverĀ as this user will stall the session and eventually cause adclient to disconnect, following messages can be captured from debug log:
Jan 17 15:34:06 host adclient[2961]: DEBUG <fd:28 PAMVerifyPassword > dns.findkdc KDC locator for domain.com
Jan 17 15:34:52 host sshd[29990]: Invalid user rlevin1 from 123.456.789.123
Jan 17 15:34:52 host cdcwatch[2962]: ERROR cdcwatch detected adclient is not running properly (ping took 30 seconds)
...
Jan 17 15:35:21 host adclient[30042]: DEBUG <fd:27 PAMVerifyPassword > dns.findkdc KDC locator for domain.com
Jan 17 15:40:11 host cdcwatch[30043]: DEBUG lrpc.session New socket 8 (142709)
Jan 17 15:40:41 host cdcwatch[30043]: DEBUG cdcwatch signalling adclient[30042] with SIGABRT
Workaround:
Uncheck "Do not require Kerberos Preauthentication" option in ADUC for target user.
Resolution:
This has been fixed in Centrify DirectControl 5.1.0 and above.