[SSSD] [Solved] Unable to auth using SSSD on RHEL 5

Eric linux_4_u at yahoo.com
Thu Nov 3 21:00:16 UTC 2011


I finally solved this problem. The box where I was able to ssh to had UsePAM yes in the sshd_config.



----- Original Message -----
From: Eric <linux_4_u at yahoo.com>
To: Development of the System Security Services Daemon <sssd-devel at lists.fedorahosted.org>
Cc: 
Sent: Thursday, November 3, 2011 2:18 PM
Subject: Re: [SSSD] Unable to auth using SSSD on RHEL 5



However, I was able to get sssd-1.2.1-39 working on another box (RHEL 5.5). I have attached the logs (sanitized) and sssd.conf file.
Would this not point to more of an issue with sssd (or my configuration of sssd/pam/nss) as opposed to openssh-4.3p2-72.el5_7.5?


-Eric



----- Original Message -----
From: Stephen Gallagher <sgallagh at redhat.com>
To: sssd-devel at lists.fedorahosted.org
Cc: 
Sent: Wednesday, November 2, 2011 1:38 PM
Subject: Re: [SSSD] Unable to auth using SSSD on RHEL 5

On Wed, 2011-11-02 at 11:25 -0700, Eric wrote:
> I have been unable to auth using ssh and sssd.
> 
> I have attached my sssd.conf (sanitized) and sssd_LDAP.conf
> (sanitized), sssd.log, sssd_pam.log, sssd_nss.log.
> 
> My ldap server is OpenLDAP 2.4.23. The system is a RHEL 5.5.
> 
> I am seeing the following in /var/log/secure:  masterldap sshd[3299]:
> error: Could not get shadow information for testuser  masterldap
> sshd[3299]: Failed password for testuser from 192.168.0.10 port 46521
> ssh2
> 
> I am able to do an ldap bind using
> uid=testuser,ou=People,dc=mydomain,dc=org so the password hash appears
> to be correct.
> 
> I am using the package sssd-1.5.1-37.el5 and sssd-client-1.5.1-37.el5
> 
> Any help would be greatly appreciated. I can provide more information
> upon request.

This looks like a bug in sshd to me. According to the logs you sent us,
SSH asked for getpwnam('testuser'), then initgroups('testuser') and then
nothing after that.

The PAM log did not show any attempt to contact SSSD to perform an
authentication. So whatever is causing the error message "Could not get
shadow information for testuser" is happening in sshd, not SSSD.

My guess is that for some reason, sshd is requiring a getspnam() call,
which SSSD doesn't support. SSSD enforces shadow password expiration and
such during the pam_account() phase of authentication, but it looks like
your version of sshd is trying to request these values and enforce it
before calling pam_authenticate().

_______________________________________________
sssd-devel mailing list
sssd-devel at lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel

_______________________________________________
sssd-devel mailing list
sssd-devel at lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list