I finally solved this problem. The box where I was able to ssh to had UsePAM yes in the
sshd_config.
----- Original Message -----
From: Eric <linux_4_u(a)yahoo.com>
To: Development of the System Security Services Daemon
<sssd-devel(a)lists.fedorahosted.org>
Cc:
Sent: Thursday, November 3, 2011 2:18 PM
Subject: Re: [SSSD] Unable to auth using SSSD on RHEL 5
However, I was able to get sssd-1.2.1-39 working on another box (RHEL 5.5). I have
attached the logs (sanitized) and sssd.conf file.
Would this not point to more of an issue with sssd (or my configuration of sssd/pam/nss)
as opposed to openssh-4.3p2-72.el5_7.5?
-Eric
----- Original Message -----
From: Stephen Gallagher <sgallagh(a)redhat.com>
To: sssd-devel(a)lists.fedorahosted.org
Cc:
Sent: Wednesday, November 2, 2011 1:38 PM
Subject: Re: [SSSD] Unable to auth using SSSD on RHEL 5
On Wed, 2011-11-02 at 11:25 -0700, Eric wrote:
I have been unable to auth using ssh and sssd.
I have attached my sssd.conf (sanitized) and sssd_LDAP.conf
(sanitized), sssd.log, sssd_pam.log, sssd_nss.log.
My ldap server is OpenLDAP 2.4.23. The system is a RHEL 5.5.
I am seeing the following in /var/log/secure: masterldap sshd[3299]:
error: Could not get shadow information for testuser masterldap
sshd[3299]: Failed password for testuser from 192.168.0.10 port 46521
ssh2
I am able to do an ldap bind using
uid=testuser,ou=People,dc=mydomain,dc=org so the password hash appears
to be correct.
I am using the package sssd-1.5.1-37.el5 and sssd-client-1.5.1-37.el5
Any help would be greatly appreciated. I can provide more information
upon request.
This looks like a bug in sshd to me. According to the logs you sent us,
SSH asked for getpwnam('testuser'), then initgroups('testuser') and then
nothing after that.
The PAM log did not show any attempt to contact SSSD to perform an
authentication. So whatever is causing the error message "Could not get
shadow information for testuser" is happening in sshd, not SSSD.
My guess is that for some reason, sshd is requiring a getspnam() call,
which SSSD doesn't support. SSSD enforces shadow password expiration and
such during the pam_account() phase of authentication, but it looks like
your version of sshd is trying to request these values and enforce it
before calling pam_authenticate().
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel