On Wed, Mar 21, 2018 at 1:26 AM, Sumit Bose <sbose(a)redhat.com>
wrote:
> On Tue, Mar 20, 2018 at 06:17:11PM -0700, Richard Sharpe wrote:
>> On Tue, Mar 20, 2018 at 1:16 AM, Sumit Bose <sbose(a)redhat.com> wrote:
>> > On Mon, Mar 19, 2018 at 04:45:12PM -0700, Richard Sharpe wrote:
>> >> Hi folks,
>> >>
>> >> It seems that once we are joined to a domain, ssh logins with local
>> >> accounts no longer work. When we unjoin from the domain, they start
>> >> working again.
>> >>
>> >> When not joined to a domain our sssd.conf file looks like this:
>> >>
>> >> [sssd]
>> >> services = nss, pac
>> >> domains =
>> >> config_file_version = 2
>> >>
>> >> When joined to a domain, our sssd.conf file looks like this:
>> >>
>> >> [sssd]
>> >> services = nss, pac
>> >> domains = win.ad.test
>> >> config_file_version = 2
>> >>
>> >> [domain/win.ad.test]
>> >> ad_domain = win.ad.test
>> >> krb5_realm = WIN.AD.TEST
>> >> realmd_tags = manages-system joined-with-samba
>> >> cache_credentials = True
>> >> id_provider = ad
>> >> default_shell = /bin/bash
>> >> ldap_sasl_authid = PD00050568C6FE8$
>> >> ldap_id_mapping = False
>> >> use_fully_qualified_names = True
>> >> fallback_homedir = /home/%u@%d
>> >> access_provider = ad
>> >> ad_hostname = PD00050568C6FE8.win.ad.test
>> >> dyndns_update = False
>> >> ldap_schema = rfc2307bis
>> >> -------------------------------
>> >>
>> >> Does anyone have any ideas on how to allow local ssh logins when
>> >> joined to a domain?
>> >
>> > How does your PAM configuration (e.g. /etc/pam.d/sshd and all included
>> > files) look like?
>>
>> What I now know after running sshd with -ddd is this:
>>
>> ---------
>> debug3: monitor_read: checking request 12^M^M
>> debug3: PAM: sshpam_passwd_conv called with 1 messages^M^M
>> debug1: PAM: password authentication failed for special2:
>> Authentication failure^M^M
>> debug3: mm_answer_authpassword: sending result 0^M^M
>> debug3: mm_request_send entering: type 13^M^M
>> Failed password for special2 from ::1 port 39826 ssh2^M^M
>> debug3: mm_auth_password: user not authenticated [preauth]^M^M
>> ---------
>>
>> When not joined to a domain, we see:
>>
>> ---------
>> debug3: mm_request_receive entering^M^M
>> debug3: monitor_read: checking request 12^M^M
>> debug3: PAM: sshpam_passwd_conv called with 1 messages^M^M
>> debug1: PAM: password authentication accepted for special2^M^M
>> debug3: mm_answer_authpassword: sending result 1^M^M
>> debug3: mm_request_send entering: type 13^M^M
>> debug3: mm_request_receive_expect entering: type 102^M^M
>> debug3: mm_request_receive entering^M^M
>> ----------
>>
>> So, now I need to debug PAM, but can't seem find anything good on how
>> to do that.
>
> How does /etc/pam.d/password-auth looks like?
>
> I would suggest to check the PAM messages in /var/log/secure or in the
> journalctl output to see which PAM module returns the error. For local
> users only pam_unix should be involved.
Well, this is all journalctl shows at the moment:
Mar 21 14:02:58
richardsha-dd1-protocols-190318203132495.lab.primarydata.com
sshd[3438]: Failed password for special2 from ::1 port 39646 ssh2
I can see this type of error messages only if I remove 'UsePAM yes' from
/etc/ssh/sshd_config. With this option I get messages like:
Mär 21 18:26:08 ipaserver.rhel74.devel unix_chkpwd[7421]: password check failed for user
(testuser)
Mär 21 18:26:08 ipaserver.rhel74.devel sshd[7420]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=testuser
Mär 21 18:26:08 ipaserver.rhel74.devel sshd[7420]: pam_sss(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=testuser
Mär 21 18:26:08 ipaserver.rhel74.devel sshd[7420]: pam_sss(sshd:auth): received for user
testuser: 10 (User not known to the underlying authentication module)
Mär 21 18:26:10 ipaserver.rhel74.devel sshd[7418]: error: PAM: Authentication failure for
testuser from ::1
bye,
Sumit
>
> This is what is in password-auth, which is standard RHEL 7.3.
>
> --------------------------
> #%PAM-1.0
> # This file is auto-generated.
> # User changes will be destroyed the next time authconfig is run.
> auth required pam_env.so
> auth [default=1 success=ok] pam_localuser.so
> auth [success=done ignore=ignore default=die] pam_unix.so
> nullok try_first_pass
> auth requisite pam_succeed_if.so uid >= 1000 quiet_success
> auth sufficient pam_sss.so forward_pass
> auth required pam_deny.so
>
> account required pam_unix.so
> account sufficient pam_localuser.so
> account sufficient pam_succeed_if.so uid < 1000 quiet
> account [default=bad success=ok user_unknown=ignore] pam_sss.so
> account required pam_permit.so
>
> password requisite pam_pwquality.so try_first_pass
> local_users_only retry=3 authtok_type=
> password sufficient pam_unix.so sha512 shadow nullok
> try_first_pass use_authtok
> password sufficient pam_sss.so use_authtok
> password required pam_deny.so
>
> session optional pam_keyinit.so revoke
> session required pam_limits.so
> -session optional pam_systemd.so
> session optional pam_oddjob_mkhomedir.so umask=0077
> session [success=1 default=ignore] pam_succeed_if.so service in
> crond quiet use_uid
> session required pam_unix.so
> session optional pam_sss.so
> -----------------------
>
> How do I get PAM to pump out more debugging info? I guess I have to
> read the PAM source code.
>
> --
> Regards,
> Richard Sharpe
> (何以解憂?唯有杜康。--曹操)
> _______________________________________________
> sssd-devel mailing list -- sssd-devel(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-devel-leave(a)lists.fedorahosted.org