[SSSD-users] sssd-ad : AD Authenticated users cant run 'su -' or 'su - root'

Jakub Hrozek jhrozek at redhat.com
Fri Jan 16 09:53:58 UTC 2015


On Thu, Jan 15, 2015 at 10:26:26PM +0100, Lukas Slebodnik wrote:
> On (15/01/15 12:57), cprice at its.to wrote:
> >
> >PLatform is RHEL 6 Update 6.
> >
> >Relevent RPMS are :
> >
> >sssd-ad-1.11.6-30.el6.x86_64
> >krb5-workstation-1.10.3-33.el6.x86_64
> >
> >Pam was setup using " authconfig --enablesssd --enablesssdauth
> >--enablemkhomedir --update"
> >
> >I have test users successfully authenticating against a test domain server
> >with both the test linux RHEL6U6 box and the Windows 2008R2 AD server on
> >an isolated subnet.
> >
> >After I login to the RHEL6U6 box with an AD user via either ssh, or via
> >the console I cannot run 'su - <username>' to any other user, either AD
> >based or local password file based. All I get is a 'incorrect password'
> >error message.
> That's interesting. Are you able to login with ssh to the machine
> with two+ users in parallel sessions.
> 
> Is there anything interesting in /var/log/secure?
> 
> I can see you have enabled debugging in domain section.
> You can filter the most critical message with next grep command.
> 
> grep -E': grep -E "\(0x00[1-9]0\)" /var/log/sssd/sssd_CORPTEST.LOCAL.log

Also -- do you initially log in from another unprivileged account or
from root?


More information about the sssd-users mailing list