<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> On 07/20/2012 03:03 PM, Joe Linoff wrote: <blockquote cite="mid:8AD4194C251EC74CB897E261038F4478010E137C@mantaray.tabula.com" type="cite"> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="Generator" content="Microsoft Word 12 (filtered medium)"> <style></style> <div class="WordSection1"> Hi Everybody:<o:p></o:p> <o:p> </o:p> I am using FreeIPA 2.2.0 on CentOS 6.3 and am having a challenging problem with a new user that I just setup. <o:p></o:p> <o:p> </o:p> That user cannot ssh into any host on the realm from an external source. They get a permission denied problem but “old-user” with the same HBAC configuration works.<o:p></o:p> <o:p> </o:p> % ssh -A -t -o Port=9346 <a class="moz-txt-link-abbreviated" href="mailto:new-user@somehost.example.com">new-user@somehost.example.com</a><o:p></o:p> <a class="moz-txt-link-abbreviated" href="mailto:new-user@somehost.example.com">new-user@somehost.example.com</a>'s password: <o:p></o:p> Permission denied, please try again.<o:p></o:p> % ssh -A -t -o Port=9346 <a class="moz-txt-link-abbreviated" href="mailto:old-user@somehost.example.com">old-user@somehost.example.com</a><o:p></o:p> <a class="moz-txt-link-abbreviated" href="mailto:old-user@somehost.example.com">old-user@somehost.example.com</a>'s password: <o:p></o:p> Last login: …<o:p></o:p> [old-user@somehost ~]$<o:p></o:p> <o:p> </o:p> I checked their password by setting up a TGT using kinit. It worked. I was also able to ssh into another host on the network.<o:p></o:p> <o:p> </o:p> % kinit new-user<o:p></o:p> Password for <a class="moz-txt-link-abbreviated" href="mailto:new-user@EXAMPLE.COM">new-user@EXAMPLE.COM</a><o:p></o:p> % ssh new-user@somehost<o:p></o:p> Last login: …<o:p></o:p> Could not chdir to home directory …<o:p></o:p> -bash-4.1$ exit<o:p></o:p> <o:p> </o:p> That seems to indicate that the password is correct and that the permissions are correct but to be sure I ran an hbactest on the server:<o:p></o:p> <o:p> </o:p> % ipa hbactest --user=new-user --service=ssh --host=somehost<o:p></o:p> --------------------<o:p></o:p> Access granted: True<o:p></o:p> --------------------<o:p></o:p> …<o:p></o:p> <o:p> </o:p> I did see something strange in /var/log/messages:<o:p></o:p> <o:p> </o:p> Jul 20 11:48:16 somehost [sssd[krb5_child[16478]]]: Decrypt integrity check failed<o:p></o:p> Jul 20 11:48:16 somehost [sssd[krb5_child[16478]]]: Decrypt integrity check failed<o:p></o:p> Jul 20 11:48:26 somehost [sssd[krb5_child[16481]]]: Decrypt integrity check failed<o:p></o:p> Jul 20 11:48:26 somehost [sssd[krb5_child[16481]]]: Decrypt integrity check failed<o:p></o:p> Jul 20 11:48:54 somehost [sssd[krb5_child[16488]]]: Password has expired<o:p></o:p> Jul 20 11:48:55 somehost [sssd[krb5_child[16488]]]: Decrypt integrity check failed<o:p></o:p> Jul 20 11:49:05 somehost [sssd[krb5_child[16491]]]: Password has expired<o:p></o:p> Jul 20 11:49:05 somehost [sssd[krb5_child[16491]]]: Decrypt integrity check failed<o:p></o:p> <o:p> </o:p> So I reset the password using the ipa passwd command:<o:p></o:p> <o:p> </o:p> % ipa passwd new-user<o:p></o:p> New Password:<o:p></o:p> Etner New Password again to verify:<o:p></o:p> -------------------------------------------<o:p></o:p> Changed password for <a class="moz-txt-link-abbreviated" href="mailto:new-user@EXAMPLE.COM">new-user@EXAMPLE.COM</a><o:p></o:p> ------------------------------------------<o:p></o:p> <o:p> </o:p> But I am still getting the Permission denied error.<o:p></o:p> <o:p> </o:p> What am I doing wrong? How can I debug this? Any help would be greatly appreciated. <o:p></o:p> <o:p> </o:p> </div> </blockquote> When you set the password on the server using the ipa passwd command you make it know to the admin. This is why it is right away expired and requires a change. A user needs to log in through the client that allows changing the password as a part of the authentication. It looks like your ssh is not configured to do password change (I suspect it uses GSSAPI but I might be wrong). So either the ssh needs to be configured to do the password change over the pam stack or you need to login as this user and change his password and then you will be able to ssh. <blockquote cite="mid:8AD4194C251EC74CB897E261038F4478010E137C@mantaray.tabula.com" type="cite"> <div class="WordSection1"> Thanks,<o:p></o:p> <o:p> </o:p> Joe<o:p></o:p> <o:p> </o:p> <o:p> </o:p> </div> <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>