On Tue, Mar 20, 2018 at 1:16 AM, Sumit Bose <sbose(a)redhat.com> wrote:
On Mon, Mar 19, 2018 at 04:45:12PM -0700, Richard Sharpe wrote:
> Hi folks,
>
> It seems that once we are joined to a domain, ssh logins with local
> accounts no longer work. When we unjoin from the domain, they start
> working again.
>
> When not joined to a domain our sssd.conf file looks like this:
>
> [sssd]
> services = nss, pac
> domains =
> config_file_version = 2
>
> When joined to a domain, our sssd.conf file looks like this:
>
> [sssd]
> services = nss, pac
> domains = win.ad.test
> config_file_version = 2
>
> [domain/win.ad.test]
> ad_domain = win.ad.test
> krb5_realm = WIN.AD.TEST
> realmd_tags = manages-system joined-with-samba
> cache_credentials = True
> id_provider = ad
> default_shell = /bin/bash
> ldap_sasl_authid = PD00050568C6FE8$
> ldap_id_mapping = False
> use_fully_qualified_names = True
> fallback_homedir = /home/%u@%d
> access_provider = ad
> ad_hostname = PD00050568C6FE8.win.ad.test
> dyndns_update = False
> ldap_schema = rfc2307bis
> -------------------------------
>
> Does anyone have any ideas on how to allow local ssh logins when
> joined to a domain?
How does your PAM configuration (e.g. /etc/pam.d/sshd and all included
files) look like?
What I now know after running sshd with -ddd is this:
---------
debug3: monitor_read: checking request 12^M^M
debug3: PAM: sshpam_passwd_conv called with 1 messages^M^M
debug1: PAM: password authentication failed for special2:
Authentication failure^M^M
debug3: mm_answer_authpassword: sending result 0^M^M
debug3: mm_request_send entering: type 13^M^M
Failed password for special2 from ::1 port 39826 ssh2^M^M
debug3: mm_auth_password: user not authenticated [preauth]^M^M
---------
When not joined to a domain, we see:
---------
debug3: mm_request_receive entering^M^M
debug3: monitor_read: checking request 12^M^M
debug3: PAM: sshpam_passwd_conv called with 1 messages^M^M
debug1: PAM: password authentication accepted for special2^M^M
debug3: mm_answer_authpassword: sending result 1^M^M
debug3: mm_request_send entering: type 13^M^M
debug3: mm_request_receive_expect entering: type 102^M^M
debug3: mm_request_receive entering^M^M
----------
So, now I need to debug PAM, but can't seem find anything good on how
to do that.
--
Regards,
Richard Sharpe
(何以解憂?唯有杜康。--曹操)