On Thu, Mar 22, 2018 at 03:23:30PM -0700, Richard Sharpe wrote:
On Wed, Mar 21, 2018 at 10:30 AM, Sumit Bose <sbose(a)redhat.com>
wrote:
> On Wed, Mar 21, 2018 at 07:08:42AM -0700, Richard Sharpe wrote:
>> On Wed, Mar 21, 2018 at 1:26 AM, Sumit Bose <sbose(a)redhat.com> wrote:
>> > On Tue, Mar 20, 2018 at 06:17:11PM -0700, Richard Sharpe wrote:
>> >> On Tue, Mar 20, 2018 at 1:16 AM, Sumit Bose <sbose(a)redhat.com>
wrote:
>> >> > On Mon, Mar 19, 2018 at 04:45:12PM -0700, Richard Sharpe wrote:
>> >> >> Hi folks,
>> >> >>
>> >> >> It seems that once we are joined to a domain, ssh logins with
local
>> >> >> accounts no longer work. When we unjoin from the domain, they
start
>> >> >> working again.
>> >> >>
>> >> >> When not joined to a domain our sssd.conf file looks like
this:
>> >> >>
>> >> >> [sssd]
>> >> >> services = nss, pac
>> >> >> domains =
>> >> >> config_file_version = 2
>> >> >>
>> >> >> When joined to a domain, our sssd.conf file looks like this:
>> >> >>
>> >> >> [sssd]
>> >> >> services = nss, pac
>> >> >> domains = win.ad.test
>> >> >> config_file_version = 2
>> >> >>
>> >> >> [domain/win.ad.test]
>> >> >> ad_domain = win.ad.test
>> >> >> krb5_realm = WIN.AD.TEST
>> >> >> realmd_tags = manages-system joined-with-samba
>> >> >> cache_credentials = True
>> >> >> id_provider = ad
>> >> >> default_shell = /bin/bash
>> >> >> ldap_sasl_authid = PD00050568C6FE8$
>> >> >> ldap_id_mapping = False
>> >> >> use_fully_qualified_names = True
>> >> >> fallback_homedir = /home/%u@%d
>> >> >> access_provider = ad
>> >> >> ad_hostname = PD00050568C6FE8.win.ad.test
>> >> >> dyndns_update = False
>> >> >> ldap_schema = rfc2307bis
>> >> >> -------------------------------
>> >> >>
>> >> >> Does anyone have any ideas on how to allow local ssh logins
when
>> >> >> joined to a domain?
>> >> >
>> >> > How does your PAM configuration (e.g. /etc/pam.d/sshd and all
included
>> >> > files) look like?
>> >>
>> >> What I now know after running sshd with -ddd is this:
>> >>
>> >> ---------
>> >> debug3: monitor_read: checking request 12^M^M
>> >> debug3: PAM: sshpam_passwd_conv called with 1 messages^M^M
>> >> debug1: PAM: password authentication failed for special2:
>> >> Authentication failure^M^M
>> >> debug3: mm_answer_authpassword: sending result 0^M^M
>> >> debug3: mm_request_send entering: type 13^M^M
>> >> Failed password for special2 from ::1 port 39826 ssh2^M^M
>> >> debug3: mm_auth_password: user not authenticated [preauth]^M^M
>> >> ---------
>> >>
>> >> When not joined to a domain, we see:
>> >>
>> >> ---------
>> >> debug3: mm_request_receive entering^M^M
>> >> debug3: monitor_read: checking request 12^M^M
>> >> debug3: PAM: sshpam_passwd_conv called with 1 messages^M^M
>> >> debug1: PAM: password authentication accepted for special2^M^M
>> >> debug3: mm_answer_authpassword: sending result 1^M^M
>> >> debug3: mm_request_send entering: type 13^M^M
>> >> debug3: mm_request_receive_expect entering: type 102^M^M
>> >> debug3: mm_request_receive entering^M^M
>> >> ----------
>> >>
>> >> So, now I need to debug PAM, but can't seem find anything good on
how
>> >> to do that.
>> >
>> > How does /etc/pam.d/password-auth looks like?
>> >
>> > I would suggest to check the PAM messages in /var/log/secure or in the
>> > journalctl output to see which PAM module returns the error. For local
>> > users only pam_unix should be involved.
>>
>> Well, this is all journalctl shows at the moment:
>>
>> Mar 21 14:02:58
>>
richardsha-dd1-protocols-190318203132495.lab.primarydata.com
>> sshd[3438]: Failed password for special2 from ::1 port 39646 ssh2
>
> I can see this type of error messages only if I remove 'UsePAM yes' from
> /etc/ssh/sshd_config. With this option I get messages like:
>
> Mär 21 18:26:08 ipaserver.rhel74.devel unix_chkpwd[7421]: password check failed for
user (testuser)
> Mär 21 18:26:08 ipaserver.rhel74.devel sshd[7420]: pam_unix(sshd:auth):
authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=testuser
> Mär 21 18:26:08 ipaserver.rhel74.devel sshd[7420]: pam_sss(sshd:auth):
authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=testuser
> Mär 21 18:26:08 ipaserver.rhel74.devel sshd[7420]: pam_sss(sshd:auth): received for
user testuser: 10 (User not known to the underlying authentication module)
> Mär 21 18:26:10 ipaserver.rhel74.devel sshd[7418]: error: PAM: Authentication
failure for testuser from ::1
After a lot of digging, I have found:
1. We have not changes UsePAM to no. It is still at UsePam Yes.
2. The /etc/pam.d/* files are stock standard,
3. However.
Unknown to me we have a modified version of pam_unix.so.
Do you know in which way it behaves differently?
The changes that are made to /etc/pam.d/password-auth-ac when we use
realm join (I assume) are causing the problem.
Did you modify /etc/pam.d/password-auth-ac manually as well?
Can you send me a before and after version of the file?
We do not need to enable domain-based logins via ssh, so is there some
way to stop authconfig or whatever it is from rewriting
/etc/pam.d/passwrord-auth-ac?
The commands called by realmd are defined in
/usr/lib/realmd/realmd-distro.conf. You should be able to overwrite
sssd-enable-logins and sssd-enable-logins by adding a [commands] section
with new versions of the options to /etc/realmd.conf.
HTH
bye,
Sumit
>
> --
> Regards,
> Richard Sharpe
> (何以解憂?唯有杜康。--曹操)
> _______________________________________________
> sssd-devel mailing list -- sssd-devel(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-devel-leave(a)lists.fedorahosted.org