Posts made by chunter2

Just replying to this with some updated information after my latest upgrade to Ubuntu 20.04 so I don’t forget on the next upgrade. I couldn’t get the fog installer to work without the -X option but figured out what the issue was. I needed to edit the /etc/pam.d/common-password file and change the following line to 10000 instead of 1000.

password        [success=3 default=ignore]      pam_krb5.so minimum_uid=1000

This was because the fogproject user was more than 1000, so changing it to 10000 let the installer work without needing the -X option and the password was updated properly. I then switched it back to 1000 so kerberos would work with my AD accounts.

@sebastian-roth Thanks for the reply. Yes, I think adding an appropriate message would be nice. I’ll keep the image that causes the 2725 error around just in case but at this point I’m not quite sure how or what else to debug. If you have any thoughts in the future and would like me to test just let me know.

Thanks

@sebastian-roth I think I may have tracked down my issue and I think it may be my fault. In my testing I was able to manually change the computer name and then the client would join the domain. I then disconnected from the domain and changed the name back to the original name and rebooted. The client then renamed the computer and joined the domain by itself. I decided to take an image of the machine at this point by first disabling the change hostname and join domain options in the fog web gui for that machine and then rename the computer back again and disconnect from the domain. I then loaded this new image on the same machine after re-enabling the change hostname and join domain in the fog web gui, and loaded it on a second machine and they both renamed and joined properly. My guess is I had never joined the domain with the first image I created. It was as clean an image as I could get. If this makes sense I think this was my issue.

Thanks

@sebastian-roth Not sure if I’m reading the code correctly but doesn’t the RenameComputer function in HostnameChanger.cs happen before the RenameComputer function in the WindowsHostName.cs file? If so I think the Environment.MachineName.Equals call is already incorrect meaning it thinks the computer has already been renamed. I thought the RenameComputer function call to the WindowsHostName.cs file was in the try right after the “Renaming host to” log message which in my case I never get to. Hope this makes sense.

Thanks

@sebastian-roth Sounds good. One more point of interest. If I remove that if completely the computer gets renamed and joins the domain correctly. I guess leaving it that way will make the client try to change the name and attempt to join the domain over and over again.

Thanks

@sebastian-roth I took some time to do a little debugging into my issue and it seems that the following line in fog-client\Modules\HostnameChanger\HostnameChanger.cs isn’t working correctly in Windows 10 (21H2).

if (Environment.MachineName.Equals(msg.Hostname.ToLower(), StringComparison.OrdinalIgnoreCase))

When I print out Environment.MachineName it shows the updated name even though the actual machine name has not been changed. I can check it in the Windows settings to make sure. It looks like Environment.MachineName is being updated before the name is actually changed. I think this explains why if I manually change the machine name it then joins the domain properly. Any thoughts?

Thanks

Just trying to get a Windows 10 machine to connect to my AD domain. I’m running FOG 1.5.9 on Ubuntu 18.04 and I’ve finally been able to upgrade my domain from NT4 to AD. I’m running the 0.12.0 client but get the following error message. If I manually change the computer name to what it should be, fog then connected to the domain and everything else seems fine. I re-imaged back to Windows 7 just to see and both the name change and joining the domain work properly. So it only seems to be the name change on Windows 10 that’s an issue. Any ideas what the 2725 error is?

------------------------------------------------------------------------------
--------------------------------HostnameChanger-------------------------------
------------------------------------------------------------------------------
 2022-01-15 11:16:50 AM Client-Info Client Version: 0.12.0
 2022-01-15 11:16:50 AM Client-Info Client OS:      Windows
 2022-01-15 11:16:50 AM Client-Info Server Version: 1.5.9
 2022-01-15 11:16:50 AM Middleware::Response Success
 2022-01-15 11:16:50 AM HostnameChanger Checking Hostname
 2022-01-15 11:16:50 AM HostnameChanger Hostname is correct
 2022-01-15 11:16:50 AM HostnameChanger Attempting to join domain
 2022-01-15 11:17:20 AM HostnameChanger Unknown Return Code:  2725

Thanks

@Sebastian-Roth Just tested this out and it works. I just modified the inventory_report.report.php file to match your change.

Thanks

@Sebastian-Roth Now that I’ve upgraded my system to 1.5.9 I tried out the Inventory Report again. If I choose a model name from the list but not a group name I seem to get all machines instead of just the specific model. The list seems to be the same as when I don’t choose any model name or group. Should I be able to choose a model without a group?

Thanks

@Sebastian-Roth Just upgraded my production machine to 1.5.9 without using the -X option and it worked. I think the difference is on my test system I’ve migrated from a Samba NT4 domain to a Samba Active Directory domain. If you want any extra info on my test system to fix anything with the installer just let me know but I think I’m good to go.

Thanks

@Sebastian-Roth I did a ‘su fogproject’ and entered the password and it worked so I didn’t bother setting it again. I then ran the setup with the -X and besides the password error again it passed everything else and it seems to be up and running. Any reason why an upgrade is trying to set the password again? Is it maybe for upgrades from older versions of fog?

Thanks

Here’s the output of those commands.

grep passwd /etc/nsswitch.conf
passwd:         files winbind compat systemd

grep -e kerberos -e krb /etc/pam.d/*
/etc/pam.d/common-account:account       required                        pam_krb5.so minimum_uid=1000
/etc/pam.d/common-auth:auth     [success=3 default=ignore]      pam_krb5.so minimum_uid=1000
/etc/pam.d/common-auth:auth     [success=1 default=ignore]      pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login try_first_pass
/etc/pam.d/common-password:password     [success=3 default=ignore]      pam_krb5.so minimum_uid=1000
/etc/pam.d/common-session:session       optional                        pam_krb5.so minimum_uid=1000
/etc/pam.d/common-session-noninteractive:session        optional                        pam_krb5.so minimum_uid=1000

Thanks

I just tried doing an upgrade from 1.5.6 to 1.5.9 and ran into the following. I get the following error on the screen.

 * Checking package: zlib1g....................................OK

 * Configuring services

 * Setting up fogproject user..................................Skipped
 * Locking fogproject as a system account......................OK
 * Setting up fogproject password..............................Failed!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!! The installer was not able to run all the way to the end as   !!
!! something has caused it to fail. The following few lines are  !!
!! from the error log file which might help us figure out what's !!
!! wrong. Please add this information when reporting an error.   !!
!! As well you might want to take a look at the full error log   !!
!! in /home/omega/fogproject-master/bin/error_logs/fog_error_1.5.9.log !!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

passwd: password unchanged
Current Kerberos password: Current Kerberos password: passwd: Authentication token manipulation error
passwd: password unchanged
Current Kerberos password: Current Kerberos password: passwd: Authentication token manipulation error
passwd: password unchanged

Here’s what’s in the log file.

ii  zlib1g:amd64   1:1.2.11.dfsg-0ubuntu2 amd64        compression library - runtime
Current Kerberos password: Current Kerberos password: passwd: Authentication token manipulation error
passwd: password unchanged
Current Kerberos password: Current Kerberos password: passwd: Authentication token manipulation error
passwd: password unchanged
Current Kerberos password: Current Kerberos password: passwd: Authentication token manipulation error
passwd: password unchanged
Current Kerberos password: Current Kerberos password: passwd: Authentication token manipulation error
passwd: password unchanged
Current Kerberos password: Current Kerberos password: passwd: Authentication token manipulation error
passwd: password unchanged
Current Kerberos password: Current Kerberos password: passwd: Authentication token manipulation error
passwd: password unchanged
Current Kerberos password: Current Kerberos password: passwd: Authentication token manipulation error
passwd: password unchanged
Current Kerberos password: Current Kerberos password: passwd: Authentication token manipulation error
passwd: password unchanged
Current Kerberos password: Current Kerberos password: passwd: Authentication token manipulation error
passwd: password unchanged
Current Kerberos password: Current Kerberos password: passwd: Authentication token manipulation error
passwd: password unchanged

Any ideas? This is on a test system I cloned from production.

Thanks

@Sebastian-Roth All the net use and net session commands return “There are no entries in the list”. So there’s nothing to delete. I’m connected using RDP on all these machines (good and bad images) so I can’t stop the lanmanworkstation service. If I run net use or net session on a good image I get the same message. I think network packets and debug logging on the samba server makes sense to try next. I’ll have to look into that.

@Sebastian-Roth Thanks for that info. Took me a while to realize where the button was. Not like it’s not big enough.

Here’s what I’ve found so far. On a good image or bad image whether I’m joined to the domain or not IsJoindToDomain() always throws on the using (var domain = Domain.GetComputerDomain()) line. Not sure what the purpose of that is but I’m running an NT4 domain, not an AD domain so it could be for that. Because this function fails the client is always calling NetJoinDomain() on every loop.

On a good image that’s disconnected from the domain the first call to DomainWrapper() always fails. I think it’s because my ADOU is always empty. Again something with an NT4 domain? The return value is 50 so then DomainWrapper() is called again with false set. And then it connects.

On a bad image that’s disconnected from the domain the first call to DomainWrapper() fails with a 1219 and then doesn’t try again. I tried adding 1219 to the switch to call again with false set but it fails with a 1219 as well. Not sure what to try next.

Thanks

@Sebastian-Roth I decided to remove the client and re-install it on this machine and now I get a different error in the fog log. It keeps looping on this.

------------------------------------------------------------------------------
--------------------------------Authentication--------------------------------
------------------------------------------------------------------------------
 13/09/2019 3:06 PM Client-Info Version: 0.11.16
 13/09/2019 3:06 PM Client-Info OS:      Windows
 13/09/2019 3:06 PM Middleware::Authentication Waiting for authentication timeout to pass
 13/09/2019 3:08 PM Middleware::Communication Download: http://xxx.xxx.xxx.xxx/fog/management/other/ssl/srvpublic.crt
 13/09/2019 3:08 PM Data::RSA FOG Server CA cert found
 13/09/2019 3:08 PM Middleware::Authentication Cert OK
 13/09/2019 3:08 PM Middleware::Authentication No token found at C:\Program Files (x86)\FOG\token.dat, this is expected if the client has not authenticated before
 13/09/2019 3:08 PM Middleware::Authentication ERROR: Could not get security token
 13/09/2019 3:08 PM Middleware::Authentication ERROR: Could not find file 'C:\Program Files (x86)\FOG\token.dat'.
 13/09/2019 3:08 PM Middleware::Communication POST URL: http://xxx.xxx.xxx.xxx/fog/management/index.php?sub=requestClientInfo&authorize&newService
 13/09/2019 3:08 PM Middleware::Response Invalid security token

I’m wondering if maybe this is the real problem. Do you know what this means?

Thanks

@Sebastian-Roth I was actually able to compile that dll myself. Looks like it’s throwing on the GetComputerDomain() line in both cases. Trying to join the domain and after I manually join the domain. So I don’t think that’s the problem. It’s failing on the NetJoinDomain() function. I think I need to print out the variables to see if they’re the same for a good image and a bad one.

@Sebastian-Roth Would it be possible to get a dll with logging showing which of the following is failing? And maybe the return value of the ones that aren’t?

                using (var domain = Domain.GetComputerDomain())
                {
                    var currentIP = Dns.GetHostAddresses(domain.Name);
                    var targetIP = Dns.GetHostAddresses(idealDomain);

                    return (currentIP.Intersect(targetIP).Any());
                }

@Sebastian-Roth Do you know what function produces that log message? Just wondering if I can do some googling on the error message.

@Sebastian-Roth I tried re-installing last night but ran out of time. I had an old version of Windows 7 that needed a bunch of updates before the fog client would install and run. I’ll have to try again another time.

I did try your debug Module.dll from the other thread and got the following in the log.

------------------------------------------------------------------------------
--------------------------------HostnameChanger-------------------------------
------------------------------------------------------------------------------
 12/09/2019 4:14 PM Client-Info Client Version: 0.11.16
 12/09/2019 4:14 PM Client-Info Client OS:      Windows
 12/09/2019 4:14 PM Client-Info Server Version: 1.5.6
 12/09/2019 4:14 PM Middleware::Response Success
 12/09/2019 4:14 PM HostnameChanger Checking Hostname
 12/09/2019 4:14 PM HostnameChanger Hostname is correct
 12/09/2019 4:14 PM HostnameChanger RenameComputer returned properly, trying register/join next.
 12/09/2019 4:14 PM HostnameChanger Checking AD params before join.
 12/09/2019 4:14 PM HostnameChanger Attempting to join domain
 12/09/2019 4:14 PM HostnameChanger Unable to resolve domain DNS name: The local computer is not joined to a domain or the domain cannot be contacted.
 12/09/2019 4:14 PM HostnameChanger Unknown Return Code:  1219
------------------------------------------------------------------------------

Does that extra log message help at all? When I ran out if time I just re-imaged back to the image that has the join problem.

Thanks