Just in case it helps to get more visibility on this issue, following you can find the
related logs to a failed attempt to run sudo in the CentOS 6 server by a IPA user:
/var/log/secure Log:
Jul 6 21:41:05.664 sshd[9160]: pam_unix(sshd:auth): authentication failure; logname=
uid=0 euid=0 tty=ssh ruser= rhost=172.29.1.95 user=my.user
Jul 6 21:41:05.738 sshd[9160]: pam_sss(sshd:auth): authentication failure; logname= uid=0
euid=0 tty=ssh ruser= rhost=172.29.1.95 user=my.user
Jul 6 21:41:05.738 sshd[9160]: pam_sss(sshd:auth): received for user my.user: 17 (Failure
setting user credentials)
Jul 6 21:41:07.913 sshd[9160]: Failed password for my.user from 172.29.1.95 port 52664
ssh2
krb5_child.log:
(Sat Jul 6 21:41:05 2019) [[sssd[krb5_child[9167]]]] [main] (0x0400): krb5_child
started.
(Sat Jul 6 21:41:05 2019) [[sssd[krb5_child[9167]]]] [unpack_buffer] (0x0100): cmd [241]
uid [645100025] gid [645100025] validate [true] enterprise principal [false] offline
[false] UPN [my.user(a)IPA.MYDOMAIN.LOCAL]
(Sat Jul 6 21:41:05 2019) [[sssd[krb5_child[9167]]]] [unpack_buffer] (0x0100): ccname:
[FILE:/tmp/krb5cc_645100025_XXXXXX] old_ccname: [not set] keytab: [/etc/krb5.keytab]
(Sat Jul 6 21:41:05 2019) [[sssd[krb5_child[9167]]]] [k5c_setup_fast] (0x0100):
SSSD_KRB5_FAST_PRINCIPAL is set to
[host/clienthostname.mysubdomain.mydomain.local(a)IPA.MYDOMAIN.LOCAL]
(Sat Jul 6 21:41:05 2019) [[sssd[krb5_child[9167]]]] [check_fast_ccache] (0x0200): FAST
TGT is still valid.
(Sat Jul 6 21:41:05 2019) [[sssd[krb5_child[9167]]]] [become_user] (0x0200): Trying to
become user [645100025][645100025].
(Sat Jul 6 21:41:05 2019) [[sssd[krb5_child[9167]]]] [set_lifetime_options] (0x0100):
Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.
(Sat Jul 6 21:41:05 2019) [[sssd[krb5_child[9167]]]] [set_lifetime_options] (0x0100):
Cannot read [SSSD_KRB5_LIFETIME] from environment.
(Sat Jul 6 21:41:05 2019) [[sssd[krb5_child[9167]]]] [set_canonicalize_option] (0x0100):
SSSD_KRB5_CANONICALIZE is set to [true]
(Sat Jul 6 21:41:05 2019) [[sssd[krb5_child[9167]]]] [main] (0x0400): Will perform online
auth
(Sat Jul 6 21:41:05 2019) [[sssd[krb5_child[9167]]]] [get_and_save_tgt] (0x0400):
Attempting kinit for realm [IPA.MYDOMAIN.LOCAL]
(Sat Jul 6 21:41:05 2019) [[sssd[krb5_child[9167]]]] [get_and_save_tgt] (0x0020): 1232:
[-1765328174][Generic preauthentication failure]
(Sat Jul 6 21:41:05 2019) [[sssd[krb5_child[9167]]]] [map_krb5_error] (0x0020): 1301:
[-1765328174][Generic preauthentication failure]
(Sat Jul 6 21:41:05 2019) [[sssd[krb5_child[9167]]]] [k5c_send_data] (0x0200): Received
error code 1432158215
(Sat Jul 6 21:41:05 2019) [[sssd[krb5_child[9167]]]] [main] (0x0400): krb5_child
completed successfully
sssd-clienthostname.log:
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [be_get_account_info]
(0x0200): Got request for [0x3][BE_REQ_INITGROUPS][1][name=my.user]
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [be_req_set_domain]
(0x0400): Changing request domain from [mysubdomain.mydomain.local] to
[mysubdomain.mydomain.local]
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[sdap_get_initgr_next_base] (0x0400): Searching for users with base
[cn=accounts,dc=ipa,dc=mydomain,dc=local]
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(uid=my.user)(objectclass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))][cn=accounts,dc=ipa,dc=mydomain,dc=local].
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [sdap_save_user]
(0x0400): Save user
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [sdap_get_primary_name]
(0x0400): Processing object my.user
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [sdap_save_user]
(0x0400): Processing user my.user
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [sdap_save_user]
(0x0400): Adding original memberOf attributes to [my.user].
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [sdap_save_user]
(0x0400): Adding user principal [my.user(a)IPA.MYDOMAIN.LOCAL] to attributes of [my.user].
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [sdap_save_user]
(0x0400): Storing info for user my.user
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [sdap_get_primary_name]
(0x0400): Processing object my.user
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [sdap_has_deref_support]
(0x0400): The server supports deref method OpenLDAP
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[sdap_x_deref_search_send] (0x0400): Dereferencing entry
[uid=my.user,cn=users,cn=accounts,dc=ipa,dc=mydomain,dc=local] using OpenLDAP deref
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to
base.
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [no
filter][uid=my.user,cn=users,cn=accounts,dc=ipa,dc=mydomain,dc=local].
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[sdap_x_deref_parse_entry] (0x0400): Got deref control
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[sdap_x_deref_parse_entry] (0x0400): All deref results from a single control parsed
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [sdap_get_primary_name]
(0x0400): Processing object admins
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [sdap_get_primary_name]
(0x0400): Processing object trust admins
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [sdap_get_primary_name]
(0x0400): Processing object productionenv_usr
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [sdap_get_primary_name]
(0x0400): Processing object stagingenv_usr
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [sdap_get_primary_name]
(0x0400): Processing object suplm_usr
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [sdap_get_initgr_done]
(0x0400): Primary group already cached, nothing to do.
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:IPA:mysubdomain.mydomain.local:bd314ac5-8764-00d8-870a-004945771b51))][cn=Default
Trust View,cn=views,cn=accounts,dc=ipa,dc=mydomain,dc=local].
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [acctinfo_callback]
(0x0100): Request processed. Returned 0,0,Success
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [be_req_set_domain]
(0x0400): Changing request domain from [mysubdomain.mydomain.local] to
[mysubdomain.mydomain.local]
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [be_pam_handler]
(0x0100): Got request with the following data
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [pam_print_data]
(0x0100): command: SSS_PAM_AUTHENTICATE
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [pam_print_data]
(0x0100): domain: mysubdomain.mydomain.local
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [pam_print_data]
(0x0100): user: my.user
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [pam_print_data]
(0x0100): service: sshd
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [pam_print_data]
(0x0100): tty: ssh
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [pam_print_data]
(0x0100): ruser:
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [pam_print_data]
(0x0100): rhost: 172.29.1.95
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [pam_print_data]
(0x0100): authtok type: 1
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [pam_print_data]
(0x0100): newauthtok type: 0
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [pam_print_data]
(0x0100): priv: 1
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [pam_print_data]
(0x0100): cli_pid: 9160
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [pam_print_data]
(0x0100): logon name: not set
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA'
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [resolve_srv_send]
(0x0200): The status of SRV lookup is resolved
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[be_resolve_server_process] (0x0200): Found address for server
ipa-server1.ipa.mydomain.local: [192.168.101.108] TTL 1200
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [ipa_resolve_callback]
(0x0400): Constructed uri 'ldap://ipa-server1.ipa.mydomain.local'
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [write_pipe_handler]
(0x0400): All data has been sent!
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [read_pipe_handler]
(0x0400): EOF received, client finished
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(cn=ipaConfig)(objectClass=ipaGuiConfig))][cn=etc,dc=ipa,dc=mydomain,dc=local].
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]] [child_sig_handler]
(0x0100): child [9167] finished successfully.
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[ipa_get_migration_flag_done] (0x0100): Password migration is not enabled.
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[be_pam_handler_callback] (0x0100): Backend returned: (0, 17, <NULL>) [Success]
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[be_pam_handler_callback] (0x0100): Sending result [17][mysubdomain.mydomain.local]
(Sat Jul 6 21:41:05 2019) [sssd[be[mysubdomain.mydomain.local]]]
[be_pam_handler_callback] (0x0100): Sent result [17][mysubdomain.mydomain.local]
Regards...