-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/02/2010 11:26 AM, Patrik Martinsson wrote:
Ok, thanks again for the patience.
I've realized that I misunderstood that part about the authentication
and the binding against ldap, thanks very much for the explanation.
Now it works correctly with the lookup of the users, however i cant get
it to work with pam, i havent digged that deep yet, but here's what i did.
Added the pam_sss.so to /etc/pam/system-auth accourding to your website
and tried to log in and realized it didn't work.
It's definitely contacting sssd and sssd is trying to look up the user
but fails for some reason, I tried with both auth_providers (krb/ldap)
and both yield the same results, here's the log, maybe you have some
suggestions to that too ?
As i said earlier, a regular kinit username works so the kerberos config
should be ok.
If i run, sssd --debug-to-files with auth_provider krb5 the
krb5_child.log is empty.
Here's how it looks when i use the -d10 and sshing to the machine with
auth_provide krb5.
You probably don't have SSH set up to use PAM for authentication. Just
to try something before we go down that path, can you try logging in on
a local console?
The log file you attached in your email doesn't show any attempt to
perform an authentication. It would have been MUCH more verbose.
As far as setting up SSH, look in your /etc/ssh/sshd_config file for the
'use_pam' option. There are comments in the default config file that
explains how to set this up properly (it's not the default, I don't think)
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAkxW5RMACgkQeiVVYja6o6MLigCeOc7+motfBXih1XKJnCC3qGW5
lEIAn2xRG7nP65lOwQzqXgLnPAOth9eo
=7MGu
-----END PGP SIGNATURE-----