Scott Z. via FreeIPA-users wrote:
> It's happened 5 or 6 times over the past year that users attempting to
> log in to various Linux servers (using our IdM servers for
> authentication) are unable to do so. When we look in the
> /var/log/secure file on the client servers, we see messages that look
> like this:
> /pam_unix(sshd:auth): authentication failure; logname= <balhblah>.../
> /pam_sss(sshd:auth): authentication success; logname= <blahblah>... /
> /pam_sss(sshd:account): User info message: Permission denied.
> /
> /pam_sss(sshd:account): system info: [The user account is expired on the
> AD server]/
> /pam_sss(sshd:account): Access denied for user <username>: 13 (User
> account has expired)/
> /pam_unix(sshd:auth): authentication failure; logname= <balhblah>.../
> /pam_sss(sshd:auth): authentication success; logname= <blahblah>... /
> /Failed password for <username> from <ip address> port 64452 ssh2/
> /fatal: Access denied for uesr <username> by PAM account configuration
> [preauth]/
>
> The users account is both good and valid, and his password is correct.Â
> The 'fix' for when we see this is to stop the sssd service, clear the
> local cache ("/rm -rf /var/lib/sss/db/*/"), and then restart the sssd
> service. Once we do that, the user is able to log back in no problem.
>
> As far as I can tell this is a problem with the client server itself,
> NOT FreeIPA because I don't think the client is actually sending the
> login request back to the IdM server, but is there any way I can check
> on logs on the FreeIPA server to see if it's getting the authorization
> request to begin with? I've only ever seen this on our Linux server
> that authorize through FreeIPA, not any other ones.
> Mahalo!
What version of IPA and sssd?
Is the user in fact an AD user?
rob