No, it's not true. It's random ... it not depends (maybe)
from the server.
You can find attached the debug logs from the test client, thanks
Hi,
at the end of the logs you can see the evaluation of the HBAC rules:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_evaluate] (0x0100): [<
hbac_evaluate()
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_req_debug_print] (0x2000):
REQUEST:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print]
(0x2000): service [sshd]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print]
(0x2000): service_group (none)
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print]
(0x2000): user [morgan.marodin]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print]
(0x2000): user_group (none)
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print]
(0x2000): targethost [
]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print]
(0x2000): targethost_group (none)
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print]
(0x2000): srchost [192.168.100.252]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print]
(0x2000): srchost_group (none)
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_req_debug_print] (0x2000):
request time 2019-02-21 16:04:23
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_debug_print] (0x2000):
RULE [allow_ipa_it_mysite] [ENABLED]:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_debug_print] (0x2000):
services:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_element_debug_print]
(0x2000): category [0x1] [ALL]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_debug_print] (0x2000):
users:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_element_debug_print]
(0x2000): category [0] [NONE]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_element_debug_print]
(0x2000): users_names (none)
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_element_debug_print]
(0x2000): users_groups:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_element_debug_print]
(0x2000): [ipa_it_mysite]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_debug_print] (0x2000):
targethosts:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_element_debug_print]
(0x2000): category [0x1] [ALL]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_debug_print] (0x2000):
srchosts:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_element_debug_print]
(0x2000): category [0x1] [ALL]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_evaluate] (0x0100): The rule
[allow_ipa_it_mysite] did not match.
......
The allow_ipa_it_mysite and all other rules do not match because
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print]
(0x2000): user_group (none)
Earlier in the logs, when the group memberships of the user are looked up:
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]] [ipa_s2n_get_user_done] (0x0400):
Received [7] groups in group list from IPA Server
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]] [ipa_s2n_get_user_done] (0x0400):
[morgan.marodin(a)mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]] [ipa_s2n_get_user_done] (0x0400):
[local proxy exclusion(a)mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]] [ipa_s2n_get_user_done] (0x0400):
[mysite signature(a)mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]] [ipa_s2n_get_user_done] (0x0400):
[mysite users(a)mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]] [ipa_s2n_get_user_done] (0x0400):
[ipa admins(a)mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]] [ipa_s2n_get_user_done] (0x0400):
[mysite it(a)mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]] [ipa_s2n_get_user_done] (0x0400):
[domain users(a)mydomain.com].
there are only groups from the AD domain and the IPA group memberships are
missing.
I would expect that 'id morgan.marodin(a)mydomain.com' only returns the groups
listed above both on the client and on the server. Since the client gets the
group-memberships from the server the next step would be to check the server
logs.
For this please call 'sss_cache -E' on the server to invalidate the cache on
the server and then 'id morgan.marodin(a)mydomain.com' on the server and send the
logs covering the time of the id request. Please do not forget to set
debug_level=9 in the [nss] and [domain/...] sections on the IPA server.
bye,
Sumit
Il giorno gio 21 feb 2019 alle ore 16:01 Sumit Bose via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> ha scritto:
> On Thu, Feb 21, 2019 at 03:47:15PM +0100, Morgan Marodin via FreeIPA-users
> wrote:
> > I did some tests, because some times SSH logins worked ... and sometimes
> > not.
> >
> > It seems that the problem is not client side:
> > - if I stop the 1st IPA server I'm able to login via SSH via AD
> credentials
> > - if I stop the 2nd one (after started the other one, naturally) the
> issue
> > appears again
> >
> > With only the issued server started the I'm able to do a *kinit*
> correctly.
> > What could I check server side?
>
> I think it would be better to check the SSSD logs on the client side.
> Please add debug_level=9 to the [pam] and [domain/...] sections of
> sssd.conf, restart SSSD and retry the login with only the 1st server
> running to reproduce the issue.
>
> According to the log snippet you send earlier, it is expected that kinit
> works fine because the authentication step 'pam_sss(sshd:auth)' was
> successful. This is the step which does a similar operation as kinit.
> The failure was in the next step 'pam_sss(sshd:access)' which is access
> control.
>
> bye,
> Sumit
>
> >
> > Please let me know, thanks.
> > Morgan
> >
> > Il giorno mar 19 feb 2019 alle ore 19:57 Sumit Bose via FreeIPA-users <
> > freeipa-users(a)lists.fedorahosted.org> ha scritto:
> >
> > > On Tue, Feb 19, 2019 at 06:19:18PM +0100, Morgan Marodin via
> FreeIPA-users
> > > wrote:
> > > > Hi everybody.
> > > >
> > > > I have just upgraded my cluster from FreeIPA 4.4.0-14 to 4.6.4-10.
> > > > All is good, logging via IPA credentials, HBAC and sudo rules are
> > > working.
> > > > I have only a issue logging via SSH with AD credentials. Before the
> > > upgrade
> > > > all was working well.
> > > >
> > > > I think that the trust is ok, because *kinit*, *ipa hbactest* and
> *ipa
> > > > trustdomain-find* (on both ipa servers) are working well:
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > > *[root@mlv-ipasrv01 ~]# ipa trustdomain-find
MYDOMAIN.COM
> > > > <
http://MYDOMAIN.COM> Domain name:
mydomain.com <
>
http://mydomain.com>
> > > > Domain NetBIOS name: MYDOMAIN Domain Security Identifier:
> > > > S-1-5-21-3367759252-2451474351-126822339 Domain enabled:
> > > > True----------------------------Number of entries returned
> > > > 1----------------------------[root@mlv-ipasrv01 ~]# ipa hbactest
> > > > --user=morgan.marodin(a)mydomain.com
<morgan.marodin(a)mydomain.com>
> > > > --host=mlv-testipa01.ipa.mydomain.com
> > > > <
http://mlv-testipa01.ipa.mydomain.com>Service:
> > > > sshd--------------------Access granted: True--------------------
> Matched
> > > > rules: allow_ad_ipa_admins Not matched rules: allow_ad_ipa_apps
Not
> > > > matched rules: allow_ipa_it_mysite[root@mlv-testipa01 ~]# kinit
> > > > morgan.marodin(a)mydomain.com
<morgan.marodin(a)mydomain.com>Password
> for
> > > > morgan.marodin(a)mydomain.com
> > > > <morgan.marodin@mydomain.com>:[root@mlv-testipa01 ~]#
klistTicket
> cache:
> > > > KEYRING:persistent:0:0Default principal: morgan.marodin(a)MYDOMAIN.COM
> > > > <morgan.marodin(a)MYDOMAIN.COM>Valid starting Expires
> > > > Service principal02/19/2019 17:55:23 02/20/2019 03:55:23
> > > > krbtgt/MYDOMAIN.COM(a)MYDOMAIN.COM <MYDOMAIN.COM(a)MYDOMAIN.COM>
> > > renew
> > > > until 02/20/2019 17:55:18*
> > > >
> > > > This is the error log:
> > > >
> > > >
> > > >
> > > >
> > > > *[root@mlv-testipa01 ~]# tail -f /var/log/secureFeb 19 18:03:21
> > > > mlv-testipa01 sshd[378408]: pam_sss(sshd:auth): authentication
> success;
> > > > logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.252
> > > > user=morgan.marodin(a)mydomain.com
<morgan.marodin(a)mydomain.com>Feb 19
> > > > 18:03:21 mlv-testipa01 sshd[378408]: pam_sss(sshd:account): Access
> denied
> > > > for user morgan.marodin(a)mydomain.com
<morgan.marodin(a)mydomain.com>:
> 6
> > > > (Permission denied)
> > >
> > > This is returned by SSSD, please add debug_level=9 to the [domain/...]
> > > section of sssd.conf, restart, SSSD and try to login again. In the
> > > domain log you should find the evaluation of the HBAC rules which might
> > > explain why access was denied.
> > >
> > > > Feb 19 18:03:21 mlv-testipa01 sshd[378401]: error: PAM:
> > > > User account has expired for morgan.marodin(a)mydomain.com
> > > > <morgan.marodin(a)mydomain.com> from 192.168.100.252
> > >
> > > I'm not sure where this message comes from. I had a short look at the
> > > ssh and PAM source code, but so far didn't find a matching messages.
> > >
> > > bye,
> > > Sumit
> > >
> > > > Feb 19 18:03:21
> > > > mlv-testipa01 sshd[378401]: fatal: monitor_read: unpermitted request
> 104*
> > > >
> > > > It seems a problem with pam and sssd.
> > > > Do you have any suggestions?
> > > >
> > > > Thanks, bye.
> > > > Morgan
> > >
> > > > _______________________________________________
> > > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > > To unsubscribe send an email to
> > > freeipa-users-leave(a)lists.fedorahosted.org
> > > > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> > > > List Guidelines:
>
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives:
> > >
>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > > _______________________________________________
> > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> > > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> > > List Guidelines:
>
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> > >
>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > >
>
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>