Am 2017-11-21 11:26, schrieb Jakub Hrozek via FreeIPA-users:
On Tue, Nov 21, 2017 at 08:36:16AM +0100, Ray via FreeIPA-users wrote:
Hi,
yesterday I noticed a strange issue on a Centos 7 client running ipa-client-4.5.0-21.el7.centos.2.2.x86_64:
My daughter tried to log in to the machine and was kicked out again after GNOME failed to load (/home on kerberized NFS4). Closer inspection showed that she had no permission to access her home directory, so GNOME was unable to read its settings.
This worked before.
I asked her to log into a text console. She got / as her home directory, as again, she was unable to access her actual home directory.
I checked with klist that she got a ticket. All seemed fine there (TGT present).
Tried 'cd' again: Permission denied.
Then I asked her to kinit once more. She hacken in her password again and got a new ticket.
Tried 'cd' again, et voila!: It cding to her NFS4 home directory worked immediately.
Questions:
- What could be the reason for this behaviour? The box was freshly
booted and I don't see what might have been wrong with the first ticket.
- Where should I look (which logs, etc.) to investigate this
further?
Does the faulty user account come from the IPA domain or a trusted AD domain?
I'm running FreeIPA 4.5 with four repicas on CentOS 7. No AD around anywhere.
Server version: ipa-server-4.5.0-21.el7.centos.2.2.x86_64
Another weird thing is that I was able to log in without issues on the same client when my daughter couldn't. My account comes from the same group of FreeIPA Servers/replicas.
Best, Ray