Adsys can't feth GPOs

[JuarezPrates]

Bad, maybe no understandable english ahead.

Can't find anything related to this on Github, Canonical Forums, Reddit or StackOverflow.

On Ubuntu 22.04, I've followed the Wiki tutorial and verified all steps on Integration Ubuntu Desktop whitepaper. Currently using SSSD backend, I can log with Active Directory users however when adsys is installed I can't fetch GPOs. In this version the error is:

ERROR Error from server: error while updating policy: can't get policies for "ubuntu": can't download all gpos and assets: one or more error while fetching GPOs and assets: can't download "ubuntuRoot": can't check if ubuntuRoot needs refreshing: no GPT.INI file: cannot open smb://addc01.domain.com.br/SysVol/domain.com.br/Policies/{DF072E7E-6F2F-46D1-A90F-699415F72F2E}/GPT.INI: invalid argument

It happens when using adsysctl update -m or adsysctl update username@domain.com.br /tmp/krb5c_getentId_randomdnumber and just adsysctl update too.

I've upgrade the machine to 22.10 and the error changed to:

ERROR Error from server: error while updating policy: can't get policies for "ubuntu": failed to retrieve the list of GPO (exited with 1): exit status 1 Failed to bind - LDAP client internal error: NT_STATUS_INVALID_PARAMETER Failed to connect to 'ldap://addc01.domain.com.br' with backend 'ldap': LDAP client internal error: NT_STATUS_INVALID_PARAMETER Failed to open session: (1, 'LDAP client internal error: NT_STATUS_INVALID_PARAMETER').

After upgrade to 23.04 the error persist same as the above.

Full info 22.04 (-vvvv verbose):

INFO No configuration file: Config File "adsys" Not Found in "[/home/jzprates /root /etc /usr/sbin]". We will only use the defaults, env variables or flags. DEBUG Connecting as [[2504:109556]] DEBUG New request /service/UpdatePolicy DEBUG Requesting with parameters: IsComputer: true, All: false, Target: ubuntu, Krb5Cc: DEBUG NormalizeTargetName for "ubuntu", type "computer" DEBUG Check if grpc request peer is authorized DEBUG Authorized as being administrator DEBUG GetPolicies for "ubuntu", type "computer" DEBUG Getting gpo list with arguments: "--objectclass computer ldap://addc01.domain.com.br ubuntu" DEBUG GPO "ubuntuRoot" for "ubuntu" available at "smb://addc01.domain.com.br/SysVol/domain.com.br/Policies/{DF072E7E-6F2F-46D1-A90F-699415F72F2E}" DEBUG Analyzing "assets" DEBUG Analyzing "ubuntuRoot" INFO No assets directory with GPT.INI file found on AD, skipping assets download ERROR Error from server: error while updating policy: can't get policies for "ubuntu": can't download all gpos and assets: one or more error while fetching GPOs and assets: can't download "ubuntuRoot": can't check if ubuntuRoot needs refreshing: no GPT.INI file: cannot open smb://addc01.domain.com.br/SysVol/domain.com.br/Policies/{DF072E7E-6F2F-46D1-A90F-699415F72F2E}/GPT.INI: invalid argument

Full info 23.04 (-vvvv verbose):

INFO No configuration file: Config File "adsys" Not Found in "[/home/jzprates /root /etc /usr/sbin]". DEBUG Connecting as [[58811:006019]] DEBUG New request /service/UpdatePolicy DEBUG Requesting with parameters: IsComputer: true, All: false, Target: ubuntu, Krb5Cc: DEBUG NormalizeTargetName for "ubuntu", type "computer" DEBUG Check if grpc request peer is authorized DEBUG Authorized as being administrator DEBUG GetPolicies for "ubuntu", type "computer" DEBUG Getting gpo list with arguments: "--objectclass computer ldap://addc01.domain.com.br ubuntu" ERROR Error from server: error while updating policy: can't get policies for "ubuntu": failed to retrieve the list of GPO (exited with 1): exit status 1 Failed to bind - LDAP client internal error: NT_STATUS_INVALID_PARAMETER Failed to connect to 'ldap://addc01.domain.com.br' with backend 'ldap': LDAP client internal error: NT_STATUS_INVALID_PARAMETER Failed to open session: (1, 'LDAP client internal error: NT_STATUS_INVALID_PARAMETER')

Additional info:

Domain Controller and machine are on the same subnet without firewall on any level; Domain Controller is a Windows Server 2019 updated to the last security version; Both machine and user are on the same OU with "no heritage" enabled and just one policy added to permit username@domain.com.br to become root; The info header directory is "/home/jzprates" on both logs because I've collected them using the local account using "sudo adsysctl update -m -vvvv"; If I disable Adsys login on pam-auth-update, Ubuntu creates a homedir and enter correctly with domain users.

ProblemType: Bug DistroRelease: Ubuntu 23.04 Package: adsys 0.11.0 ProcVersionSignature: Ubuntu 6.2.0-23.23-generic 6.2.12 Uname: Linux 6.2.0-23-generic x86_64 ApportVersion: 2.26.1-0ubuntu2 Architecture: amd64 CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Mon Jun 19 11:22:10 2023 InstallationDate: Installed on 2023-06-13 (5 days ago) InstallationMedia: Ubuntu 22.04.2 LTS "Jammy Jellyfish" - Release amd64 (20230223) RelatedPackageVersions: sssd 2.8.1-1ubuntu1 python3-samba 2:4.17.7+dfsg-1ubuntu1 SourcePackage: adsys UpgradeStatus: Upgraded to lunar on 2023-06-16 (2 days ago) modified.conffile..etc.polkit-1.localauthority.conf.d.99-adsys-privilege-enforcement.conf: [deleted] modified.conffile..etc.sudoers.d.99-adsys-privilege-enforcement: [deleted]

[JuarezPrates]

After enabling log level 10 on smb.conf I'm getting this info:

adsysctl update username@domain.com.br /tmp/krb5cc_1766406888_c2PVrz -vvvv
INFO Using configuration file: /etc/adsys.yaml
DEBUG Connecting as [[30795:156699]]
DEBUG New request /service/UpdatePolicy
DEBUG Requesting with parameters: IsComputer: false, All: false, Target: username@domain.com.br, Krb5Cc: /tmp/krb5cc_1766406888_c2PVrz DEBUG NormalizeTargetName for "username@domain.com.br", type "user" DEBUG Check if grpc request peer is authorized
DEBUG Polkit call result, authorized: true
DEBUG GetPolicies for "username@domain.com.br", type "user" DEBUG Getting gpo list with arguments: "--objectclass user ldap://addc01.domain.com.br username@domain.com.br" ERROR Error from server: error while updating policy: can't get policies for "username@domain.com.br": failed to retrieve the list of GPO (exited with 1): exit status 1 INFO: Current debug levels: all: 10 tdb: 10 printdrivers: 10 lanman: 10 smb: 10 rpc_parse: 10 rpc_srv: 10 rpc_cli: 10 passdb: 10 sam: 10 auth: 10 winbind: 10 vfs: 10 idmap: 10 quota: 10 acls: 10 locking: 10 msdfs: 10 dmapi: 10 registry: 10 scavenger: 10 dns: 10 ldb: 10 tevent: 10 auth_audit: 10 auth_json_audit: 10 kerberos: 10 drs_repl: 10 smb2: 10 smb2_credits: 10 dsdb_audit: 10 dsdb_json_audit: 10 dsdb_password_audit: 10 dsdb_password_json_audit: 10 dsdb_transaction_audit: 10 dsdb_transaction_json_audit: 10 dsdb_group_audit: 10 dsdb_group_json_audit: 10 Processing section "[printers]" Processing section "[print$]" pm_process() returned Yes Security token SIDs (1): SID[ 0]: S-1-5-18 Privileges (0xFFFFFFFFFFFFFFFF): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): resolve_lmhosts: Attempting lmhosts lookup for name addc01.domain.com.br<0x20> getlmhostsent: lmhost entry: 192.168.1.71 ADDC01 getlmhostsent: lmhost entry: 192.168.1.72 ADDC02 GENSEC backend 'gssapi_spnego' registered GENSEC backend 'gssapi_krb5' registered GENSEC backend 'gssapi_krb5_sasl' registered GENSEC backend 'spnego' registered GENSEC backend 'schannel' registered GENSEC backend 'ncalrpc_as_system' registered GENSEC backend 'sasl-EXTERNAL' registered GENSEC backend 'ntlmssp' registered GENSEC backend 'ntlmssp_resume_ccache' registered GENSEC backend 'http_basic' registered GENSEC backend 'http_ntlm' registered GENSEC backend 'http_negotiate' registered GENSEC backend 'krb5' registered GENSEC backend 'fake_gssapi_krb5' registered Starting GENSEC mechanism spnego Starting GENSEC submechanism gssapi_krb5 cli_credentials(WORKGROUP\root) without realm, cannot use kerberos for this connection ldap/addc01.domain.com.br Failed to start GENSEC client mech gssapi_krb5: NT_STATUS_INVALID_PARAMETER gensec_spnego_create_negTokenInit_step: Failed to setup SPNEGO negTokenInit request gensec_update_send: spnego[0x2317de0]: subreq: 0x236b110 gensec_update_done: spnego[0x2317de0]: NT_STATUS_INVALID_PARAMETER tevent_req[0x236b110/../../auth/gensec/spnego.c:1631]: state[3] error[-7963671676338569203 (0x917B5ACDC000000D)] state[struct gensec_spnego_update_state (0x236b2d0)] timer[(nil)] finish[../../auth/gensec/spnego.c:1947] Failed to bind - LDAP client internal error: NT_STATUS_INVALID_PARAMETER Failed to connect to 'ldap://addc01.domain.com.br' with backend 'ldap': LDAP client internal error: NT_STATUS_INVALID_PARAMETER Failed to open session: (1, 'LDAP client internal error: NT_STATUS_INVALID_PARAMETER')

I've added a adsys.yaml file with the default parameters just to get rid of that line in the beginning.

adsys.yaml

verbose: 2 socket: /run/adsysd.sock

service_timeout: 3600 ad_server: ldap://addc01.domain.com.br ad_domain: domain.com.br cache_dir: /tmp/adsysd/cache run_dir: /tmp/adsysd/run dconf_dir: /etc/dconf sss_cache_dir: /etc/dconf sudoers_dir: /etc/sudoers.d policykit_dir: /etc/polkit-1 client_timeout: 60

[denisonbarbosa]

Hey @JuarezPrates, thanks for reporting the issue! On Kinetic (22.10) and Lunar (23.04), there was a massive samba update that changed a bit of how things used to work with the Kerberos backend and this resulted in some bad things happening. Those are fixed now, but we didn't SRU the changes to those releases yet.

On Jammy (22.04), this problem does not exist so I'll focus on it with you if that's alright... The error you've mentioned:

ERROR Error from server: error while updating policy: can't get policies for "ubuntu": can't download all gpos and assets: one or more error while fetching GPOs and assets: can't download "ubuntuRoot": can't check if ubuntuRoot needs refreshing: no GPT.INI file: cannot open smb://addc01.domain.com.br/SysVol/domain.com.br/Policies/{DF072E7E-6F2F-46D1-A90F-699415F72F2E}/GPT.INI: invalid argument

It seems as though your policy directory does not have any GPT.INI file. This is the file that adsys uses to identify whether there were any changes in the policy definitions and if it needs to reapply them or not. Would you mind checking in the AD server if that's really the case (the absence of a GPT.INI file)? Also, make sure that the casing is right. Since Windows is not case sensitive, some namings like GPT.ini or GpT.InI will still work on Windows machines, but that's not the case for Linux ones.

[JuarezPrates]

Hi. Yes, the GPT.INI is present and uppercase in the domain controller. And the user have the rights to read and write in this folder.

[jmarti4203]

We are seeing the same issue in our environment as well and I have not been able to resolve or find much information on this.

[octan81]

I have the same issue in my environment. I'm actively trying to find a work around. Anyone have any luck with this?

[JuarezPrates]

I don't have time to test it in a lab enviroment with a brand new Active Directory Server, but I think it's the only thing I haven't checked yet.

[jmarti4203]

I can do a cifs mount to the GPT.INI file like you can and open it just fine but Adsys and Smbclient will fail out trying to hit those directly. I did notice smbclient works when using the -D flag....smbclient //example.com/sysvol -D "example.com/policies/{policy}" Without that flag (smbclient //example.com/sysvol/example.com/policies/{policy}) it comes back with tree connect failed: NT_STATUS_BAD_NETWORK_NAME Case matching doesn't seem to make a difference for me. I thought it was a client side configuration problem and have been tinkering with SMB.conf but I had not gotten anywhere.

[JuarezPrates]

I think the problem might be in one of this files: adsys-gpolist or adsys-gpolist_test.go. I was grepping for NT_STATUS_BAD_NETWORK_NAME or NT_STATUS_INVALID_PARAMETER and found nothing, execpt for these two.

[jmarti4203]

I don't have a way to rule this out unfortunately. We do not have an assets (Ubuntu) folder that is being referenced here. I am not sure if because of that, Adsys totally craps out. I can use smbget and pull gpt.ini files without any issues as well.

This is made reference to in the ADWatch Daemon documentation