Hi, Lukas
Sorry I gave this output since the wiki stated "If the user info can be retrieved,
but authentication fails, the first place to look into is /var/log/secure or the system
journal"
So you want me to post the sssd.log in /var/log/sssd/sssd?
Yes I saw that my PAM stack is starting with krb, then going to winbind, and finally sssd.
I have no clue how to just make it use sssd (perhaps this is the problem?)
Thanks,
Thomas
________________________________________
From: Lukas Slebodnik <lslebodn(a)redhat.com>
Sent: Tuesday, August 9, 2016 2:47 PM
To: End-user discussions about the System Security Services Daemon
Subject: [SSSD-users] Re: SSSD-PAM failure
On (09/08/16 18:19), thomas.beaudry(a)concordia.ca wrote:
Hi, thanks for responding, I thought that a response would have come
to my email, instead of here. Sorry for the delay. I set the debug level to 9. Here is
the log:
Aug 9 14:17:01 tbeaudry CRON[2826]: pam_unix(cron:session): session opened for user root
by (uid=0)
Aug 9 14:17:01 tbeaudry CRON[2826]: pam_unix(cron:session): session closed for user root
Aug 9 14:17:43 tbeaudry sudo: root : problem with defaults entries ; TTY=pts/1 ;
PWD=/var/log ;
Aug 9 14:17:43 tbeaudry sudo: root : TTY=pts/1 ; PWD=/var/log ; USER=root ;
COMMAND=/usr/sbin/service sssd restart
Aug 9 14:17:43 tbeaudry sudo: pam_unix(sudo:session): session opened for user root by
(uid=0)
Aug 9 14:17:43 tbeaudry sudo: pam_unix(sudo:session): session closed for user root
Aug 9 14:17:43 tbeaudry sssd_be: GSSAPI client step 1
Aug 9 14:17:43 tbeaudry sssd_be: message repeated 2 times: [ GSSAPI client step 1]
Aug 9 14:17:43 tbeaudry sssd_be: GSSAPI client step 1
Aug 9 14:17:43 tbeaudry sssd_be: message repeated 2 times: [ GSSAPI client step 1]
Aug 9 14:17:43 tbeaudry sssd_be: GSSAPI client step 2
Aug 9 14:17:43 tbeaudry sssd_be: GSSAPI client step 1
Aug 9 14:17:43 tbeaudry sssd_be: message repeated 2 times: [ GSSAPI client step 1]
Aug 9 14:17:43 tbeaudry sssd_be: GSSAPI client step 2
Aug 9 14:17:46 tbeaudry su[2579]: pam_unix(su:session): session closed for user root
Aug 9 14:17:55 tbeaudry su[2871]: pam_krb5(su:auth): (user tbeaudry) credential
verification failed: Server not found in Kerberos database
Aug 9 14:17:55 tbeaudry su[2871]: pam_krb5(su:auth): authentication failure;
logname=tbeaudry uid=1000 euid=0 tty=/dev/pts/1 ruser=tmtg rhost=
Aug 9 14:17:55 tbeaudry su[2871]: pam_unix(su:auth): authentication failure; logname=
uid=1000 euid=0 tty=/dev/pts/1 ruser=tmtg rhost= user=tbeaudry
Aug 9 14:17:55 tbeaudry su[2871]: pam_winbind(su:auth): getting password (0x00000388)
Aug 9 14:17:55 tbeaudry su[2871]: pam_winbind(su:auth): pam_get_item returned a password
Aug 9 14:17:55 tbeaudry su[2871]: pam_winbind(su:auth): internal module error (retval =
PAM_AUTHINFO_UNAVAIL(9), user = 'tbeaudry')
Aug 9 14:17:55 tbeaudry su[2871]: pam_sss(su:auth): authentication failure; logname=
uid=1000 euid=0 tty=/dev/pts/1 ruser=tmtg rhost= user=tbeaudry
Aug 9 14:17:55 tbeaudry su[2871]: pam_sss(su:auth): received for user tbeaudry: 6
(Permission denied)
Aug 9 14:17:57 tbeaudry su[2871]: pam_authenticate: Authentication failure
Aug 9 14:17:57 tbeaudry su[2871]: FAILED su for tbeaudry by tmtg
Aug 9 14:17:57 tbeaudry su[2871]: - /dev/pts/1 tmtg:tbeaudry
sssd does not log to
syslog/journald by default.
You should look into /var/log/sssd as it is described on wiki[1]
BTW we can see that your pam-stack is not the ideal.
You should use either pam_winbind or pam_sss and
pam_sss can do the same as pam_krb5
LS
https://fedorahosted.org/sssd/wiki/Troubleshooting#SSSDdebuglogs
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org