Lukas Slebodnik <lslebodn(a)redhat.com> hat am 14. November 2016
um 10:04
geschrieben:
On (13/11/16 16:03), ronnyforberger(a)ronnyforberger.de wrote:
>I found out, that /var/run/sss needed mode 0755.
>
>But I still cannot use passwords.
>My /etc/pam.d/system looks like the following:
>
What do you meand by cannot use password?
How do you authenticate ssh (or login on tty)
Are you able to resolve user with "getent passwd" or "id"?
I
cannot login using password or use sudo using password. Neigher by ssh, login
on tty.
I can see the users through getent passwd and id.
The debug log of pam_sssd.so says:
Nov 13 17:31:59 macy sudo: in openpam_dispatch(): /usr/local/lib/pam_sss.so:
pam_sm_authenticate(): authentication error
Nov 13 17:32:01 macy su: in openpam_dispatch(): calling pam_sm_setcred() in
/usr/local/lib/pam_sss.so
Nov 13 17:32:01 macy su: in pam_get_item(): entering: PAM_SERVICE
Nov 13 17:32:01 macy su: in pam_get_item(): returning PAM_SUCCESS
Nov 13 17:32:01 macy su: in pam_get_item(): entering: PAM_USER
Nov 13 17:32:01 macy su: in pam_get_item(): returning PAM_SUCCESS
Nov 13 17:32:01 macy su: in pam_get_item(): entering: PAM_TTY
Nov 13 17:32:01 macy su: in pam_get_item(): returning PAM_SUCCESS
Nov 13 17:32:01 macy su: in pam_get_item(): entering: PAM_RUSER
Nov 13 17:32:01 macy su: in pam_get_item(): returning PAM_SUCCESS
Nov 13 17:32:01 macy su: in pam_get_item(): entering: PAM_RHOST
Nov 13 17:32:01 macy su: in pam_get_item(): returning PAM_SUCCESS
Nov 13 17:32:01 macy su: in pam_get_item(): entering: PAM_AUTHTOK
Nov 13 17:32:01 macy su: in pam_get_item(): returning PAM_SUCCESS
Nov 13 17:32:01 macy su: in pam_get_item(): entering: PAM_OLDAUTHTOK
Nov 13 17:32:01 macy su: in pam_get_item(): returning PAM_SUCCESS
Nov 13 17:32:01 macy su: in pam_set_data(): entering: 'pam_sss:fd_destructor'
Nov 13 17:32:01 macy su: in pam_set_data(): returning PAM_SUCCESS
Nov 13 17:32:01 macy su: in openpam_dispatch(): /usr/local/lib/pam_sss.so:
pam_sm_setcred(): success
What can be the problem?
Best regards,
Ronny
># auth
>auth sufficient pam_opie.so no_warn no_fake_prompts
>auth requisite pam_opieaccess.so no_warn allow_local
>#auth sufficient pam_krb5.so no_warn try_first_pass
>#auth sufficient pam_ssh.so no_warn try_first_pass
>auth sufficient /usr/local/lib/pam_sss.so
>auth required pam_unix.so no_warn try_first_pass nullok
>
># account
>#account required pam_krb5.so
>account required pam_login_access.so
>account required pam_unix.so
>account required /usr/local/lib/pam_sss.so ignore_unknown_user
There should be also enabled ignore_authinfo_unavail
># session
>#session optional pam_ssh.so want_agent
>session required pam_lastlog.so no_fail
>session optional /usr/local/lib/pam_sss.so
>
># password
>#password sufficient pam_krb5.so no_warn try_first_pass
>password sufficient /usr/local/lib/pam_sss.so use_authtok
>password required pam_unix.so no_warn try_first_pass
>
BTW here is a link to our troubleshooting wiki
https://fedorahosted.org/sssd/wiki/Troubleshooting
LS
_______________________________________________
sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
___________________________________
Ronny Forberger
ronnyforberger at ronnyforberger.de
PGP:
http://www.ronnyforberger.de/pgp/email-encryption.html