[SSSD] Access denied by pam_sss(sshd:account)

Sumit Bose sbose at redhat.com
Wed Jun 26 16:36:44 UTC 2013


On Wed, Jun 26, 2013 at 06:10:55PM +0200, Mathieu Bouillaguet wrote:
> Hello,
> 
> We are trying to setup Kerberos authentication for our linux VMs on an
> Active Directory.
> 
> We use Red Hat 6.2, the sssd version is 1.5.1.-66.el6.
> 
> getent retrieve the domain users and groups.
> 
> If I try to ssh into the VM I am disconnected with "pam_sss(sshd:account)
> access denied for user". The pam authentication module succeed as seen in
> the log but the account management module reject me each time.
> 
> If I comment the line "account [default=bad success=ok user_unknown=ignore]
> pam_sss.so" in the /etc/pam.d/password-auth fileI can login via ssh. If I
> comment it in the /etc/pam.d/system-auth file I can log in locally.
> 
> I can't find the reason why this pam_sss account management module rejects
> me. I didn't find anything interesting in the logs. I looked in the
> /var/log/secure, /var/log/sssd/sssd_pam.log /var/log/sssd/sssd_*domain*.log,
> I even searched in the source code but to no avail.

...

can you send your sssd.conf so that we can see which access provider is
configured? E.g. if you use the krb5 access provider please have a look
at the sssd-krb5 man page, a .k5login file is needed in this case.

> 
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler] (4): Got
> request with the following data
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): command:
> PAM_ACCT_MGMT
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): domain: AOP
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): user:
> yiqevm
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): service:
> sshd
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): tty: ssh
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): ruser:
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): rhost:
> localhost
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): authtok
> type: 0
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): authtok
> size: 0
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): newauthtok
> type: 0
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): newauthtok
> size: 0
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): priv: 0
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [pam_print_data] (4): cli_pid:
> 8734
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [write_pipe_handler] (6): All
> data has been sent!
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [read_pipe_handler] (6): EOF
> received, client finished
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler_callback] (4):
> Backend returned: (0, 6, <NULL>) [Success]
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler_callback] (4):
> Sending result [6][AOP]
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [be_pam_handler_callback] (4):
> Sent result [6][AOP]
> (Wed Jun 26 12:27:39 2013) [sssd[be[AOP]]] [child_sig_handler] (4): child
> [8739] finished successfully.

The access provider rejects the access with error code 6
(PAM_PERM_DENIED). Please resend logs with a higher debug level, 10 at
best. If you prefer you can send them to me by directly.

bye,
Sumit

> 
> Any help, would be appreciated.
> 
> Thanks

> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list