[SSSD] Access denied by pam_sss(sshd:account)

Mathieu Bouillaguet mathieu.bouillaguet at gmail.com
Wed Jun 26 16:10:55 UTC 2013


Hello,

We are trying to setup Kerberos authentication for our linux VMs on an
Active Directory.

We use Red Hat 6.2, the sssd version is 1.5.1.-66.el6.

getent retrieve the domain users and groups.

If I try to ssh into the VM I am disconnected with "pam_sss(sshd:account)
access denied for user". The pam authentication module succeed as seen in
the log but the account management module reject me each time.

If I comment the line "account [default=bad success=ok user_unknown=ignore]
pam_sss.so" in the /etc/pam.d/password-auth fileI can login via ssh. If I
comment it in the /etc/pam.d/system-auth file I can log in locally.

I can't find the reason why this pam_sss account management module rejects
me. I didn't find anything interesting in the logs. I looked in the
/var/log/secure, /var/log/sssd/sssd_pam.log /var/log/sssd/sssd_*domain*.log,
I even searched in the source code but to no avail.

In the /var/log/secure file when I try a local login, I get
login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0
euid=0 tty=tty1 ruser= rhost=  user=yiqevm at AOP
login: pam_sss(login:auth): authentication success; logname=LOGIN uid=0
euid=0 tty=tty1 ruser= rhost= user=yiqevm at AOP
login: pam_sss(login:account): Access denied for user yiqevm at AOP: 6
(Permission denied)
login: Permission denied

And when I try to ssh :
sshd[8685]: pam_unix(sshd:auth): authentication failure; logname= uid=0
euid=0 tty=ssh ruser= rhost=172.34.155.223  user=yiqevm at aop
sshd[8685]: pam_sss(sshd:auth): authentication success; logname= uid=0
euid=0 tty=ssh ruser= rhost=172.34.155.223 user=yiqevm at aop
sshd[8685]: pam_sss(sshd:account): Access denied for user yiqevm at aop: 6
(Permission denied)
sshd[8685]: Failed password for yiqevm at aop from 172.34.155.223 port 51922
ssh2
sshd[8688]: fatal: Access denied for user yiqevm at aop by PAM account
configuration


In the sssd_domain.log I get :
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): command:
PAM_AUTHENTICATE
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): domain: AOP
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): user:
yiqevm
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): service:
sshd
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): tty: ssh
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): ruser:
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): rhost:
localhost
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): authtok
type: 1
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): authtok
size: 12
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): newauthtok
type: 0
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): newauthtok
size: 0
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): priv: 0
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): cli_pid:
8734
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [check_if_ccache_file_is_used]
(5): User [777778] is not active
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [check_for_valid_tgt] (3): TGT
is valid.
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [fo_resolve_service_send] (4):
Trying to resolve service 'KERBEROS'
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_resolve_server_done] (4):
Found address for server auth1.aop.chorus.aife: [172.34.154.86] TTL 3443
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [fo_resolve_service_send] (4):
Trying to resolve service 'KPASSWD'
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_resolve_server_done] (4):
Found address for server auth1.aop.chorus.aife: [172.34.154.86] TTL 3443
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [write_pipe_handler] (6): All
data has been sent!
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [read_pipe_handler] (6): EOF
received, client finished
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [fo_set_port_status] (4):
Marking port 0 of server 'auth1.aop.chorus.aife' as 'working'
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [set_server_common_status] (4):
Marking server 'auth1.aop.chorus.aife' as 'working'
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [fo_set_port_status] (4):
Marking port 88 of server 'auth1.aop.chorus.aife' as 'working'
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [set_server_common_status] (4):
Marking server 'auth1.aop.chorus.aife' as 'working'
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler_callback] (4):
Backend returned: (0, 0, <NULL>) [Success]
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler_callback] (4):
Sending result [0][AOP]
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler_callback] (4):
Sent result [0][AOP]
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [child_sig_handler] (4): child
[8738] finished successfully.
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler] (4): Got
request with the following data
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): command:
PAM_ACCT_MGMT
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): domain: AOP
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): user:
yiqevm
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): service:
sshd
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): tty: ssh
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): ruser:
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): rhost:
localhost
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): authtok
type: 0
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): authtok
size: 0
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): newauthtok
type: 0
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): newauthtok
size: 0
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): priv: 0
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): cli_pid:
8734
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [write_pipe_handler] (6): All
data has been sent!
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [read_pipe_handler] (6): EOF
received, client finished
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler_callback] (4):
Backend returned: (0, 6, <NULL>) [Success]
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler_callback] (4):
Sending result [6][AOP]
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler_callback] (4):
Sent result [6][AOP]
(Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [child_sig_handler] (4): child
[8739] finished successfully.

Any help, would be appreciated.

Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130626/ea16d087/attachment.html>


More information about the sssd-devel mailing list