<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style></style></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1>Hi Everybody:<o:p></o:p><o:p> </o:p>I am using FreeIPA 2.2.0 on CentOS 6.3 and am having a challenging problem with a new user that I just setup. <o:p></o:p><o:p> </o:p>That user cannot ssh into any host on the realm from an external source. They get a permission denied problem but “old-user” with the same HBAC configuration works.<o:p></o:p><o:p> </o:p>% ssh -A -t -o Port=9346 new-user@somehost.example.com<o:p></o:p>new-user@somehost.example.com's password: <o:p></o:p>Permission denied, please try again.<o:p></o:p>% ssh -A -t -o Port=9346 old-user@somehost.example.com<o:p></o:p>old-user@somehost.example.com's password: <o:p></o:p>Last login: …<o:p></o:p>[old-user@somehost ~]$<o:p></o:p><o:p> </o:p>I checked their password by setting up a TGT using kinit. It worked. I was also able to ssh into another host on the network.<o:p></o:p><o:p> </o:p>% kinit new-user<o:p></o:p>Password for new-user@EXAMPLE.COM<o:p></o:p>% ssh new-user@somehost<o:p></o:p>Last login: …<o:p></o:p>Could not chdir to home directory …<o:p></o:p>-bash-4.1$ exit<o:p></o:p><o:p> </o:p>That seems to indicate that the password is correct and that the permissions are correct but to be sure I ran an hbactest on the server:<o:p></o:p><o:p> </o:p>% ipa hbactest --user=new-user --service=ssh --host=somehost<o:p></o:p>--------------------<o:p></o:p>Access granted: True<o:p></o:p>--------------------<o:p></o:p>…<o:p></o:p><o:p> </o:p>I did see something strange in /var/log/messages:<o:p></o:p><o:p> </o:p>Jul 20 11:48:16 somehost [sssd[krb5_child[16478]]]: Decrypt integrity check failed<o:p></o:p>Jul 20 11:48:16 somehost [sssd[krb5_child[16478]]]: Decrypt integrity check failed<o:p></o:p>Jul 20 11:48:26 somehost [sssd[krb5_child[16481]]]: Decrypt integrity check failed<o:p></o:p>Jul 20 11:48:26 somehost [sssd[krb5_child[16481]]]: Decrypt integrity check failed<o:p></o:p>Jul 20 11:48:54 somehost [sssd[krb5_child[16488]]]: Password has expired<o:p></o:p>Jul 20 11:48:55 somehost [sssd[krb5_child[16488]]]: Decrypt integrity check failed<o:p></o:p>Jul 20 11:49:05 somehost [sssd[krb5_child[16491]]]: Password has expired<o:p></o:p>Jul 20 11:49:05 somehost [sssd[krb5_child[16491]]]: Decrypt integrity check failed<o:p></o:p><o:p> </o:p>So I reset the password using the ipa passwd command:<o:p></o:p><o:p> </o:p>% ipa passwd new-user<o:p></o:p>New Password:<o:p></o:p>Etner New Password again to verify:<o:p></o:p>-------------------------------------------<o:p></o:p>Changed password for new-user@EXAMPLE.COM<o:p></o:p>------------------------------------------<o:p></o:p><o:p> </o:p>But I am still getting the Permission denied error.<o:p></o:p><o:p> </o:p>What am I doing wrong? How can I debug this? Any help would be greatly appreciated. <o:p></o:p><o:p> </o:p>Thanks,<o:p></o:p><o:p> </o:p>Joe<o:p></o:p><o:p> </o:p><o:p> </o:p></div></body></html>