[SSSD] Unable to auth using SSSD on RHEL 5

Eric linux_4_u at yahoo.com
Wed Nov 2 18:25:46 UTC 2011


I have been unable to auth using ssh and sssd.

I have attached my sssd.conf (sanitized) and sssd_LDAP.conf (sanitized), sssd.log, sssd_pam.log, sssd_nss.log.

My ldap server is OpenLDAP 2.4.23. The system is a RHEL 5.5.

I am seeing the following in /var/log/secure:
 masterldap sshd[3299]: error: Could not get shadow information for testuser
 masterldap sshd[3299]: Failed password for testuser from 192.168.0.10 port 46521 ssh2

I am able to do an ldap bind using uid=testuser,ou=People,dc=mydomain,dc=org so the password hash appears to be correct.

I am using the package sssd-1.5.1-37.el5 and sssd-client-1.5.1-37.el5

Any help would be greatly appreciated. I can provide more information upon request.


/etc/pam.d/system-auth-ac

========================================================================

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_sss.so use_first_pass 
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow debug
account     sufficient    pam_localuser.so debug
account     sufficient    pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    sufficient    pam_sss.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     optional      pam_sss.so
session     required      pam_unix.so


==============================================================================

-Eric
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sssd_nss.log
Type: application/octet-stream
Size: 17032 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111102/f411661d/attachment.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sssd_pam.log
Type: application/octet-stream
Size: 7397 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111102/f411661d/attachment-0001.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sssd.log
Type: application/octet-stream
Size: 20065 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111102/f411661d/attachment-0002.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sssd_LDAP.log
Type: application/octet-stream
Size: 66216 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111102/f411661d/attachment-0003.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sssd.conf
Type: application/octet-stream
Size: 980 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111102/f411661d/attachment-0004.obj>


More information about the sssd-devel mailing list