there was a thread on Aug 8, 2013 that was about this error, my situation is
a little different. This happens on Ubuntu 12.04 IPA clients, which automounts
kerberized NFSv4.
I am let to believe that this error may be the cause of a weird problem that
users are able to login wither per ssh or lightdm.
Open an ssh session, type in username and password, successful authentication
is logged in auth.log, but the session just hangs at the login prompt.
=====
Nov 13 09:52:33 murjo sshd[2746]: pam_unix(sshd:auth): authentication failure; logname=
uid=0 euid=0
tty=ssh ruser= rhost=fish user=qchang
Nov 13 09:52:34 murjo sshd[2746]: pam_sss(sshd:auth): authentication success; logname=
uid=0 euid=0
tty=ssh ruser= rhost=fish user=qchang
Nov 13 09:52:34 murjo sshd[2746]: Accepted password for qchang from port 33621 ssh2
Nov 13 09:52:34 murjo sshd[2746]: pam_unix(sshd:session): session opened for user qchang
by (uid=0)
Nov 13 09:53:04 murjo sssd_be: canonuserfunc error -7
Nov 13 09:53:04 murjo sssd_be: _sasl_plugin_load failed on sasl_canonuser_init for plugin:
ldapdb
Nov 13 09:57:23 murjo sshd[902]: Received signal 15; terminating.
Nov 13 09:57:23 murjo sshd[997]: Server listening on 0.0.0.0 port 22.
Nov 13 09:57:23 murjo sshd[997]: Server listening on :: port 22.
Nov 13 09:57:34 murjo lightdm: pam_unix(lightdm:session): session opened for user lightdm
by (uid=0)
Nov 13 09:57:34 murjo lightdm: pam_ck_connector(lightdm:session): nox11 mode, ignoring
PAM_TTY :0
Nov 13 09:57:35 murjo dbus[910]: [system] Rejected send message, 2 matched rules;
type="method_call", sender=":1.16" (uid=104 pid=1554
comm="/usr/lib/indicator-datetim
e/indicator-datetime-ser") interface="org.freedesktop.DBus.Properties"
member="GetAll" error
name="(unset)" requested_reply="0" destination=":1.9" (uid=0
pid=1400 comm
="/usr/sbin/console-kit-daemon --no-daemon ")
Nov 13 09:57:43 murjo automount[1725]: canonuserfunc error -7
Nov 13 09:57:43 murjo automount[1725]: _sasl_plugin_load failed on sasl_canonuser_init for
plugin:
ldapdb
Nov 13 09:57:44 murjo automount[1725]: DIGEST-MD5 common mech free
Nov 13 09:57:44 murjo automount[1725]: canonuserfunc error -7
=====
It is probably because my home is not available at the time when auth.log says session
opened for me. I have no problem login as a local user ID with local home. Maybe SSSD
did not provide information for automount to make my home available? At the end,
after I run sudo ls -l /home as the local user, the ssh session came alive.
The strangest thing is this seems to happen randomly in terms of what host and what
time! I have a group of people on Ubuntu 12.04 calling me at different times every few
days and I have to try all kind of things to get them back, the latest is that sudo ls -l
"trick" and can not tell them for sure what is the problem:-(
Note this _never_ happens on CentOS/RHEL clients. I know, I wish I can convert them...
Please help.
SSSD information:
=====
root@host:/var/log# aptitude show sssd
Package: sssd
State: installed
Automatically installed: yes
Version: 1.8.6-0ubuntu0.3
Priority: extra
Section: universe/utils
Maintainer: Ubuntu Core Developers <ubuntu-devel(a)lists.ubuntu.com>
Architecture: amd64
Uncompressed Size: 7,978 k
Depends: libc-ares2 (>= 1.7.0), libc6 (>= 2.14), libdbus-1-3 (>= 1.1.1),
libdhash1, libini-config2,
libipa-hbac0 (= 1.8.6-0ubuntu0.3), libk5crypto3 (>= 1.6.dfsg.2),
libkrb5-3 (>= 1.9+dfsg~beta1), libldap-2.4-2 (>= 2.4.7), libldb1 (>=
0.9.21), libnspr4 (>=
1.8.0.10), libnss3 (>= 3.12.0~1.9b1), libpam0g (>= 0.99.7.1),
libpcre3 (>= 8.10), libpopt0 (>= 1.14), libtalloc2 (>=
2.0.4~git20101213), libtdb1 (>=
1.2.7+git20101214), libtevent0 (>= 0.9.9), libunistring0, upstart-job,
python, python-sss
PreDepends: multiarch-support
Recommends: ldap-utils, bind9-host, libnss-sss, libpam-sss, libsasl2-modules-gssapi-mit |
libsasl2-modules-gssapi-heimdal, libsasl2-modules-ldap
Suggests: sssd-tools
Conflicts: sssd
Description: System Security Services Daemon
Provides a set of daemons to manage access to remote directories and authentication
mechanisms. It
provides an NSS and PAM interface toward the system and a pluggable
backend system to connect to multiple different account sources. It is also the basis to
provide
client auditing and policy services for projects like FreeIPA.
This package provides the daemon.
Homepage:
https://fedorahosted.org/sssd/
=====
Thanks,
Qing Chang