On Fri, Dec 14, 2012 at 10:21:27AM -0800, Andrew Wygle wrote:
> I would like to fix the NSS issue first, chances are it's
causing the
> above error messages from PAM as well. Did you configure your PAM stack
> manually or using authconfig? Do you see pam_sss being contacted in
> /var/log/secure at all?
>
I am still seeing this problem, however, and now it's actually a problem.
When I try to log in over ssh I successfully log in and then the connection
is immediately closed, with a /var/log/secure footprint that looks ilke
this:
sshd[2070]: pam_sss(sshd:account): Request to sssd failed. Connection
refused
sshd[2071]: fatal: Access denied for user bob by PAM account configuration
sshd[2070]: Failed password for bob from 127.0.0.1 port 57093 ssh2
"Connection refused" would indicate that there is nobody listening on
the other end. pam_sss is mostly just a proxy, which marshalls the incoming
request in a format the sssd_pam process expects and sends it over a
UNIX pipe to sssd_pam.
You said before that you may have misconfigured the SSSD while building
it, is there any chance that the pam_sss module is talking to a pipe that
doesn't exist? The default pipe path is "\"VARDIR\"/lib/sss/pipes"
while
VARDIR is expanded from the value of --localstatedir during configure. I
guess that "grep ^localstatedir Makefile" is a quick way to check what
the localstatedir was configured as if you still have the sources
around.
Is the sssd_pam process running? I expect there is no sign of an
incoming request in the pam log? (/var/log/sssd/sssd_pam.log)
I thought it might be the same problem as nss so I made doublesure to copy
the correct versions of the pam_sss library, but that didn't improve things
(though since there's really no way to restart pam, I'm not exactly sure
when library changes would get incorporated). I have tried configuring PAM
several dozen different ways over the course of this project, so I'm not
sure what's going on right now, but I believe it was last configured with
authconfig. My /etc/pam.d/password-auth-ac and system-auth-ac are below:
password-auth-ac:
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass
use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session optional pam_mkhomedir.so
session [success=1 default=ignore] pam_succeed_if.so service in crond
quiet use_uid
session required pam_unix.so
session optional pam_sss.so
system-auth-ac:
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass
use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session optional pam_mkhomedir.so
session [success=1 default=ignore] pam_succeed_if.so service in crond
quiet use_uid
session required pam_unix.so
session optional pam_sss.so
The PAM config files look good to me. I think they are, indeed,
generated by authconfig.
>> I also see a Kerberos AS-REQ for
krbtgt/DOMAIN.NET
>> (which is odd because the cache contains krbtgt/DOMAIN.NET(a)DOMAIN.NET
and
>> ldap/dc.domain.net(a)DOMAIN.NET already), which is rejected with a
KRB-ERR
>> claiming principal not found.
>>
>> Finally, I occasionally (not sure exactly
>> when, but it seems to be when I try to log in with users that DO exist
>> locally) see the following in /var/log/secure:
>>
>> pam_sss(sshd:session):
>> Request to sssd failed. Connection refused
>
> Simo just posted a patch for this issue. The title of the patch is
> "[PATCH] Fix pam responder handling of coalesced requests". If you could
> give it a go, it would be awesome.
>
I am unlikely to be able to sell my boss on running code that isn't some
released version (I had enough trouble getting him to move to 1.9.3), but
I'll see what I can do. Is this a real problem that will impede
functionality, or just an annoyance?
If the sssd_be process crashed while there was a login in progress,
then the sssd_pam process wouldn't reconnect correctly and all further
connection attempts would hang.
But given that you also see connection refused with accounts that you
can resolve with getent or id now, I no longer think the patch would be
a solution to that.