PVE 5.0: Active Directory logins not working

[starkruzr]

Hi,

Where can I find logs for attempts to auth via AD? I have added my AD server and realm in Authentication, there are very few options as far as I can tell but all my attempts to authenticate users via AD are failing.

Thanks!

 

[dcsapak]

have you created the users also in proxmox? this is necessary since we do not sync the users from ad/ldap

 

[starkruzr]

Yes. Created the user in Proxmox as an AD domain user. It tries for a long time and then says login failed. I just don't know where the logs for this are saved.

 

[morph027]

Same here...login worked until last week. Probably some update refuses self signed certs now?

 

[starkruzr]

Bumping this in the hope someone can tell me where the logs are?

 

[Denny]

You will find basically the same info in messages, syslog, and kern.log. Perhaps it would be more meaningful to describe your setup in more detail. Are you using a dns name for the AD server or an IP address? Are you using ssl? The default port? A nmap scan from the proxmox server to your AD server shows which ports open?

 

[morph027]

Ok, whatever it was causing, it's gone...everything back to normal here. Weird.

 

[starkruzr]

You will find basically the same info in messages, syslog, and kern.log. Perhaps it would be more meaningful to describe your setup in more detail. Are you using a dns name for the AD server or an IP address? Are you using ssl? The default port? A nmap scan from the proxmox server to your AD server shows which ports open?

The *web application* will put logs into messages, syslog and kern.log?

• IP address
• No SSL
• Default port
• nmap:

PORT STATE SERVICE

53/tcp open domain

80/tcp open http

88/tcp open kerberos-sec

135/tcp open msrpc

139/tcp open netbios-ssn

389/tcp open ldap

443/tcp open https

445/tcp open microsoft-ds

464/tcp open kpasswd5

593/tcp open http-rpc-epmap

636/tcp open ldapssl

992/tcp open telnets

3268/tcp open globalcatLDAP

3269/tcp open globalcatLDAPssl

3389/tcp open ms-wbt-server

5555/tcp open freeciv

8080/tcp open http-proxy

8443/tcp open https-alt

49154/tcp open unknown

49155/tcp open unknown

49157/tcp open unknown

49158/tcp open unknown

49159/tcp open unknown

No surprises in there.

 

[Denny]

Authentication messages is what I was referring to. Using an IP address lets out the possibility of dns issues, no ssl lets out tls issues, and port 389 being open lets out acl issues. Maybe create a test user to let out AD strangeness?