I did some tests, because some times SSH logins worked ... and sometimes not.

It seems that the problem is not client side:
- if I stop the 1st IPA server I'm able to login via SSH via AD credentials
- if I stop the 2nd one (after started the other one, naturally) the issue appears again

With only the issued server started the I'm able to do a kinit correctly.
What could I check server side?

Please let me know, thanks.
Morgan

Il giorno mar 19 feb 2019 alle ore 19:57 Sumit Bose via FreeIPA-users <freeipa-users@lists.fedorahosted.org> ha scritto:
On Tue, Feb 19, 2019 at 06:19:18PM +0100, Morgan Marodin via FreeIPA-users wrote:
> Hi everybody.
>
> I have just upgraded my cluster from FreeIPA 4.4.0-14 to 4.6.4-10.
> All is good, logging via IPA credentials, HBAC and sudo rules are working.
> I have only a issue logging via SSH with AD credentials. Before the upgrade
> all was working well.
>
> I think that the trust is ok, because *kinit*, *ipa hbactest* and *ipa
> trustdomain-find* (on both ipa servers) are working well:
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> *[root@mlv-ipasrv01 ~]# ipa trustdomain-find MYDOMAIN.COM
> <http://MYDOMAIN.COM>  Domain name: mydomain.com <http://mydomain.com>
> Domain NetBIOS name: MYDOMAIN  Domain Security Identifier:
> S-1-5-21-3367759252-2451474351-126822339  Domain enabled:
> True----------------------------Number of entries returned
> 1----------------------------[root@mlv-ipasrv01 ~]# ipa hbactest
> --user=morgan.marodin@mydomain.com <morgan.marodin@mydomain.com>
> --host=mlv-testipa01.ipa.mydomain.com
> <http://mlv-testipa01.ipa.mydomain.com>Service:
> sshd--------------------Access granted: True--------------------  Matched
> rules: allow_ad_ipa_admins  Not matched rules: allow_ad_ipa_apps  Not
> matched rules: allow_ipa_it_mysite[root@mlv-testipa01 ~]# kinit
> morgan.marodin@mydomain.com <morgan.marodin@mydomain.com>Password for
> morgan.marodin@mydomain.com
> <morgan.marodin@mydomain.com>:[root@mlv-testipa01 ~]# klistTicket cache:
> KEYRING:persistent:0:0Default principal: morgan.marodin@MYDOMAIN.COM
> <morgan.marodin@MYDOMAIN.COM>Valid starting       Expires
> Service principal02/19/2019 17:55:23  02/20/2019 03:55:23
> krbtgt/MYDOMAIN.COM@MYDOMAIN.COM <MYDOMAIN.COM@MYDOMAIN.COM>        renew
> until 02/20/2019 17:55:18*
>
> This is the error log:
>
>
>
>
> *[root@mlv-testipa01 ~]# tail -f /var/log/secureFeb 19 18:03:21
> mlv-testipa01 sshd[378408]: pam_sss(sshd:auth): authentication success;
> logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.252
> user=morgan.marodin@mydomain.com <morgan.marodin@mydomain.com>Feb 19
> 18:03:21 mlv-testipa01 sshd[378408]: pam_sss(sshd:account): Access denied
> for user morgan.marodin@mydomain.com <morgan.marodin@mydomain.com>: 6
> (Permission denied)

This is returned by SSSD, please add debug_level=9 to the [domain/...]
section of sssd.conf, restart, SSSD and try to login again. In the
domain log you should find the evaluation of the HBAC rules which might
explain why access was denied.

> Feb 19 18:03:21 mlv-testipa01 sshd[378401]: error: PAM:
> User account has expired for morgan.marodin@mydomain.com
> <morgan.marodin@mydomain.com> from 192.168.100.252

I'm not sure where this message comes from. I had a short look at the
ssh and PAM source code, but so far didn't find a matching messages.

bye,
Sumit

> Feb 19 18:03:21
> mlv-testipa01 sshd[378401]: fatal: monitor_read: unpermitted request 104*
>
> It seems a problem with pam and sssd.
> Do you have any suggestions?
>
> Thanks, bye.
> Morgan

> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org