No, it's not true. It's random ... it not depends (maybe) from the server.
You can find attached the debug logs from the test client, thanks
Il giorno gio 21 feb 2019 alle ore 16:01 Sumit Bose via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> ha scritto:
On Thu, Feb 21, 2019 at 03:47:15PM +0100, Morgan Marodin via
FreeIPA-users
wrote:
> I did some tests, because some times SSH logins worked ... and sometimes
> not.
>
> It seems that the problem is not client side:
> - if I stop the 1st IPA server I'm able to login via SSH via AD
credentials
> - if I stop the 2nd one (after started the other one, naturally) the
issue
> appears again
>
> With only the issued server started the I'm able to do a *kinit*
correctly.
> What could I check server side?
I think it would be better to check the SSSD logs on the client side.
Please add debug_level=9 to the [pam] and [domain/...] sections of
sssd.conf, restart SSSD and retry the login with only the 1st server
running to reproduce the issue.
According to the log snippet you send earlier, it is expected that kinit
works fine because the authentication step 'pam_sss(sshd:auth)' was
successful. This is the step which does a similar operation as kinit.
The failure was in the next step 'pam_sss(sshd:access)' which is access
control.
bye,
Sumit
>
> Please let me know, thanks.
> Morgan
>
> Il giorno mar 19 feb 2019 alle ore 19:57 Sumit Bose via FreeIPA-users <
> freeipa-users(a)lists.fedorahosted.org> ha scritto:
>
> > On Tue, Feb 19, 2019 at 06:19:18PM +0100, Morgan Marodin via
FreeIPA-users
> > wrote:
> > > Hi everybody.
> > >
> > > I have just upgraded my cluster from FreeIPA 4.4.0-14 to 4.6.4-10.
> > > All is good, logging via IPA credentials, HBAC and sudo rules are
> > working.
> > > I have only a issue logging via SSH with AD credentials. Before the
> > upgrade
> > > all was working well.
> > >
> > > I think that the trust is ok, because *kinit*, *ipa hbactest* and
*ipa
> > > trustdomain-find* (on both ipa servers) are working well:
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > > *[root@mlv-ipasrv01 ~]# ipa trustdomain-find
MYDOMAIN.COM
> > > <
http://MYDOMAIN.COM> Domain name:
mydomain.com <
http://mydomain.com>
> > > Domain NetBIOS name: MYDOMAIN Domain Security Identifier:
> > > S-1-5-21-3367759252-2451474351-126822339 Domain enabled:
> > > True----------------------------Number of entries returned
> > > 1----------------------------[root@mlv-ipasrv01 ~]# ipa hbactest
> > > --user=morgan.marodin(a)mydomain.com <morgan.marodin(a)mydomain.com>
> > > --host=mlv-testipa01.ipa.mydomain.com
> > > <
http://mlv-testipa01.ipa.mydomain.com>Service:
> > > sshd--------------------Access granted: True--------------------
Matched
> > > rules: allow_ad_ipa_admins Not matched rules: allow_ad_ipa_apps Not
> > > matched rules: allow_ipa_it_mysite[root@mlv-testipa01 ~]# kinit
> > > morgan.marodin(a)mydomain.com <morgan.marodin(a)mydomain.com>Password
for
> > > morgan.marodin(a)mydomain.com
> > > <morgan.marodin@mydomain.com>:[root@mlv-testipa01 ~]# klistTicket
cache:
> > > KEYRING:persistent:0:0Default principal: morgan.marodin(a)MYDOMAIN.COM
> > > <morgan.marodin(a)MYDOMAIN.COM>Valid starting Expires
> > > Service principal02/19/2019 17:55:23 02/20/2019 03:55:23
> > > krbtgt/MYDOMAIN.COM(a)MYDOMAIN.COM <MYDOMAIN.COM(a)MYDOMAIN.COM>
> > renew
> > > until 02/20/2019 17:55:18*
> > >
> > > This is the error log:
> > >
> > >
> > >
> > >
> > > *[root@mlv-testipa01 ~]# tail -f /var/log/secureFeb 19 18:03:21
> > > mlv-testipa01 sshd[378408]: pam_sss(sshd:auth): authentication
success;
> > > logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.252
> > > user=morgan.marodin(a)mydomain.com <morgan.marodin(a)mydomain.com>Feb
19
> > > 18:03:21 mlv-testipa01 sshd[378408]: pam_sss(sshd:account): Access
denied
> > > for user morgan.marodin(a)mydomain.com <morgan.marodin(a)mydomain.com>:
6
> > > (Permission denied)
> >
> > This is returned by SSSD, please add debug_level=9 to the [domain/...]
> > section of sssd.conf, restart, SSSD and try to login again. In the
> > domain log you should find the evaluation of the HBAC rules which might
> > explain why access was denied.
> >
> > > Feb 19 18:03:21 mlv-testipa01 sshd[378401]: error: PAM:
> > > User account has expired for morgan.marodin(a)mydomain.com
> > > <morgan.marodin(a)mydomain.com> from 192.168.100.252
> >
> > I'm not sure where this message comes from. I had a short look at the
> > ssh and PAM source code, but so far didn't find a matching messages.
> >
> > bye,
> > Sumit
> >
> > > Feb 19 18:03:21
> > > mlv-testipa01 sshd[378401]: fatal: monitor_read: unpermitted request
104*
> > >
> > > It seems a problem with pam and sssd.
> > > Do you have any suggestions?
> > >
> > > Thanks, bye.
> > > Morgan
> >
> > > _______________________________________________
> > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to
> > freeipa-users-leave(a)lists.fedorahosted.org
> > > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> > > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> >
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> >
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> >
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...