Hello,
We are trying to setup Kerberos authentication for our linux VMs on an
Active Directory.
We use Red Hat 6.2, the sssd version is 1.5.1.-66.el6.
getent retrieve the domain users and groups.
If I try to ssh into the VM I am disconnected with "pam_sss(sshd:account)
access denied for user". The pam authentication module succeed as seen in
the log but the account management module reject me each time.
If I comment the line "account [default=bad success=ok user_unknown=ignore]
pam_sss.so" in the /etc/pam.d/password-auth fileI can login via ssh. If I
comment it in the /etc/pam.d/system-auth file I can log in locally.
I can't find the reason why this pam_sss account management module rejects
me. I didn't find anything interesting in the logs. I looked in the
/var/log/secure, /var/log/sssd/sssd_pam.log /var/log/sssd/sssd_*domain*.log,
I even searched in the source code but to no avail.
In the /var/log/secure file when I try a local login, I get
login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0
euid=0 tty=tty1 ruser= rhost= user=yiqevm@AOP
login: pam_sss(login:auth): authentication success; logname=LOGIN uid=0
euid=0 tty=tty1 ruser= rhost= user=yiqevm@AOP
login: pam_sss(login:account): Access denied for user yiqevm@AOP: 6
(Permission denied)
login: Permission denied
And when I try to ssh :
sshd[8685]: pam_unix(sshd:auth): authentication failure; logname= uid=0
euid=0 tty=ssh ruser= rhost=172.34.155.223 user=yiqevm@aop
sshd[8685]: pam_sss(sshd:auth): authentication success; logname= uid=0
euid=0 tty=ssh ruser= rhost=172.34.155.223 user=yiqevm@aop
sshd[8685]: pam_sss(sshd:account): Access denied for user yiqevm@aop: 6
(Permission denied)
sshd[8685]: Failed password for yiqevm@aop from 172.34.155.223 port 51922
ssh2
sshd[8688]: fatal: Access denied for user yiqevm@aop by PAM account
configuration
In the sssd_domain.log I get :
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): command:
PAM_AUTHENTICATE
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): domain: AOP
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): user:
yiqevm
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): service:
sshd
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): tty: ssh
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): ruser:
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): rhost:
localhost
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): authtok
type: 1
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): authtok
size: 12
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): newauthtok
type: 0
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): newauthtok
size: 0
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): priv: 0
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): cli_pid:
8734
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [check_if_ccache_file_is_used]
(5): User [777778] is not active
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [check_for_valid_tgt] (3): TGT
is valid.
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [fo_resolve_service_send] (4):
Trying to resolve service 'KERBEROS'
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_resolve_server_done] (4):
Found address for server auth1.aop.chorus.aife: [172.34.154.86] TTL 3443
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [fo_resolve_service_send] (4):
Trying to resolve service 'KPASSWD'
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_resolve_server_done] (4):
Found address for server auth1.aop.chorus.aife: [172.34.154.86] TTL 3443
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [write_pipe_handler] (6): All
data has been sent!
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [read_pipe_handler] (6): EOF
received, client finished
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [fo_set_port_status] (4):
Marking port 0 of server 'auth1.aop.chorus.aife' as 'working'
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [set_server_common_status] (4):
Marking server 'auth1.aop.chorus.aife' as 'working'
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [fo_set_port_status] (4):
Marking port 88 of server 'auth1.aop.chorus.aife' as 'working'
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [set_server_common_status] (4):
Marking server 'auth1.aop.chorus.aife' as 'working'
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler_callback] (4):
Backend returned: (0, 0, <NULL>) [Success]
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler_callback] (4):
Sending result [0][AOP]
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler_callback] (4):
Sent result [0][AOP]
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [child_sig_handler] (4): child
[8738] finished successfully.
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler] (4): Got
request with the following data
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): command:
PAM_ACCT_MGMT
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): domain: AOP
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): user:
yiqevm
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): service:
sshd
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): tty: ssh
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): ruser:
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): rhost:
localhost
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): authtok
type: 0
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): authtok
size: 0
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): newauthtok
type: 0
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): newauthtok
size: 0
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): priv: 0
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): cli_pid:
8734
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [write_pipe_handler] (6): All
data has been sent!
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [read_pipe_handler] (6): EOF
received, client finished
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler_callback] (4):
Backend returned: (0, 6, <NULL>) [Success]
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler_callback] (4):
Sending result [6][AOP]
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler_callback] (4):
Sent result [6][AOP]
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [child_sig_handler] (4): child
[8739] finished successfully.
Any help, would be appreciated.
Thanks