new domain creation error

[alemumol]

after I create a new domain, it pops up below error while testing.

Post "http://containers-gateway.internal:5000/ntlm/connect": context deadline exceeded (Client.Timeout exceeded while awaiting headers).

I can also telnet this service 'containers-gateway.internal:5000'.

[stgmsa]

Hi @alemumol,
could you provide the details when hitting this error ?
PacketFence version,
Fresh install or an upgrade
What is the linux version that has PacketFence installed on

This seems to be a network issue, and the information above can help us reproduce the error.
Thanks!

[alemumol]

thanks for your reply stgmsa,
PacketFence version= ZEN-v13.3.0
With Debian version = 11 and it is a fresh install

[JeGoi]

@alemumol, you mean ZEN-v13.2.0 on debian 11, correct ?
There is no v13.3 and Packetfence next iteration, the v14.0, is on debian12.

[stgmsa]

I think it's debian 14.0 on debian 11.
@lzammit and I met this issue on v14 dev + debian, its' due to a chroot issue. but since v14 will be released based on debian12, there won't be an issue like this.

[JeGoi]

So, I need to remove debian11 on 14.0.
Thanks

[wtatanka]

I also have the same problem on a new installation made like the iso of version 14.0 do you have the solution
(Post "http://containers-gateway.internal:5000/ntlm/connect": context deadline exceeded (Client.Timeout exceeded while awaiting headers))

[JeGoi]

@wtatanka you mean, you used the packetfence iso 14.0 and have the same issue, correct?
So, you are under debian12, correct?

[wtatanka]

Yes debian 12 root@ALPANAC01:~# lsb_release -a No LSB modules are available. Distributor ID: Debian Description: Debian GNU/Linux 12 (bookworm) Release: 12 Codename: bookworm root@ALPANAC01:~# Paolo Traballoni

…

Il giorno 2 ott 2024, alle ore 19:47, JeGoi ***@***.***> ha scritto: R

[wtatanka]

you can sugest solution?
root@ALPANAC01:~# telnet containers-gateway.internal 5000
Trying 100.64.0.1...
Connected to containers-gateway.internal.
Escape character is '^]'.
get

<title>Error response</title>

Error response

Error code: 400

Message: Bad request syntax ('get').

Error code explanation: 400 - Bad request syntax or unsupported method.

Connection closed by foreign host. root@ALPANAC01:~#

I solved the problem

[MarioSpenc]

Same problem here: Install a fresh 14.0 from your ISO, Import data from running version 13.1, but when connecting to AD i get error:

[JeGoi]

@MarioSpenc ISO has been updated on "2024-10-07 20:56". Are you using the last ISO?
Please, check md5sum to be sure.
I will prepare VMs to test that part.
Thanks for feedbacks.

[MarioSpenc]

Hi, md5sum is good/the same.

What the workaround is: we have set the machine account password manually - in AC with powershell, in PF in domain.conf. That works, machine is joined. Something went wrong when joining in our AD ...

[stgmsa]

@MarioSpenc
Thanks for the feedback, we'll verify both the cases mentioned.

[wtatanka]

Commet # all line on resolve.confPaolo Traballoni Il giorno 10 ott 2024, alle ore 14:20, stgmsa ***@***.***> ha scritto: @MarioSpenc Thanks for the feedback, we'll verify both the cases mentioned. —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: ***@***.***>

[JeGoi]

Hum, I am not able to reproduce.
I test it with new fresh install iso 14.0 on esx, (-/+ export/import) script + weird and insane password...
Always working...

[MarioSpenc]

JeGoi, I think the problem could be a subbug of #8301 (comment) . There is something changing in Hashmanagement in new sssd.

When I change the machine account password in Active Directory and the machine account password in domain.conf, it works.

/Mario

[JeGoi]

@MarioSpenc Could you try to change the fingerprint of the machine?
Perhaps related to: #8339
But should be on zen not iso...

rm /etc/ssh/ssh_host_*key*
ssh-keygen -A

And not sure it is related... just a try

[brandonechenique]

dear community,
I make the connection with the domain ad and at the beginning I get a test ok domain joined, but after a few seconds I get the following error:
Post “http://containers-gateway.internal:5000/ntlm/connect”: context deadline exceeded (Client.Timeout exceeded while awaiting headers)

already tried the following :
restarting the service ntlm-auth-api
changing machine password

I've installed the latest version of packetfence 14.0 and the debian version is 12.

in the server ad, i can see that the packetfence object was created in the computers group
from the server pf i make telnet to port 389 to the ad server and it connects.

What else could I check? or what steps should I do to generate a correct tshoot?

[brandonechenique]

in addition to that, I cannot generate a source authenticcation based on the ad, I always get an error with the following information:
Can't connect to server or bind with '“CN=NACPF_RADIUS2,OU=RADIUS,OU=Groups,DC=xxxxx,DC=xxxx,DC=xxxx,DC=xx”' on x.x.x.x.x.:389

[MarioSpenc]

Hi!

My recommendation is NOT to USE version 14.0 in production, due to several bugs with Active Directory integration, in special with AD structures with more than one AD server. It's nearly impossible to get it work stable.

/Mario