[SSSD] Unable to auth using SSSD on RHEL 5

Stephen Gallagher sgallagh at redhat.com
Wed Nov 2 18:38:59 UTC 2011


On Wed, 2011-11-02 at 11:25 -0700, Eric wrote:
> I have been unable to auth using ssh and sssd.
> 
> I have attached my sssd.conf (sanitized) and sssd_LDAP.conf
> (sanitized), sssd.log, sssd_pam.log, sssd_nss.log.
> 
> My ldap server is OpenLDAP 2.4.23. The system is a RHEL 5.5.
> 
> I am seeing the following in /var/log/secure:  masterldap sshd[3299]:
> error: Could not get shadow information for testuser  masterldap
> sshd[3299]: Failed password for testuser from 192.168.0.10 port 46521
> ssh2
> 
> I am able to do an ldap bind using
> uid=testuser,ou=People,dc=mydomain,dc=org so the password hash appears
> to be correct.
> 
> I am using the package sssd-1.5.1-37.el5 and sssd-client-1.5.1-37.el5
> 
> Any help would be greatly appreciated. I can provide more information
> upon request.

This looks like a bug in sshd to me. According to the logs you sent us,
SSH asked for getpwnam('testuser'), then initgroups('testuser') and then
nothing after that.

The PAM log did not show any attempt to contact SSSD to perform an
authentication. So whatever is causing the error message "Could not get
shadow information for testuser" is happening in sshd, not SSSD.

My guess is that for some reason, sshd is requiring a getspnam() call,
which SSSD doesn't support. SSSD enforces shadow password expiration and
such during the pam_account() phase of authentication, but it looks like
your version of sshd is trying to request these values and enforce it
before calling pam_authenticate().
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111102/5a104c7c/attachment.sig>


More information about the sssd-devel mailing list