<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
@font-face
{font-family:Consolas}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif"}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{margin:0in;
margin-bottom:.0001pt;
font-size:10.5pt;
font-family:Consolas}
span.EmailStyle17
{font-family:"Calibri","sans-serif";
color:windowtext}
span.PlainTextChar
{font-family:Consolas}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
-->
</style><style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1" lang="EN-US" link="blue" vlink="purple">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">I am now getting this....<br>
<br>
<br>
<div><br>
<div style="font-family: Tahoma; font-size: 13px;">
<p>regards</p>
<p>Steven Jones</p>
<p>Technical Specialist - Linux RHCE</p>
<p>Victoria University, Wellington, NZ</p>
<p>0064 4 463 6272<br>
</p>
</div>
</div>
<div style="font-family: Times New Roman; color: rgb(0, 0, 0); font-size: 16px;">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF148449"><font color="#000000" face="Tahoma" size="2"><b>From:</b> Joe Linoff [jlinoff@tabula.com]<br>
<b>Sent:</b> Tuesday, 24 July 2012 10:04 a.m.<br>
<b>To:</b> Steven Jones<br>
<b>Cc:</b> freeipa-users@redhat.com; Joe Linoff<br>
<b>Subject:</b> Re: [Freeipa-users] User can't login via ssh from external<br>
</font><br>
</div>
<div></div>
<div>
<div class="WordSection1">
<p class="MsoNormal">Hi Steve:</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Thank you for your suggestions. </p>
<p class="MsoNormal"> </p>
<p class="MsoPlainText">> In the gui you can do a hbac test of the rule.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I ran the hbactest rule testing from the command line using “ipa hbactest …”. It showed that the rules were correct. Do you think that the GUI might provide a different result?</p>
<p class="MsoNormal"> </p>
<p class="MsoPlainText"> </p>
<p class="MsoPlainText">> Also what are the UIDS? IPA provided 32bit ones? or your own?</p>
<p class="MsoPlainText"> </p>
<p class="MsoNormal">The UID’s were provided by IPA. Actually during testing I also provided my own at one point but reverted back when that didn’t seem to make a difference.
</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Can you explain why that might cause the problem? For example, would duplicates break the system or are there ranges of UIDs that are not legal?
</p>
<p class="MsoPlainText"> </p>
<p class="MsoPlainText">> I'd suggest re-setting that user's password and get them to login and reset the password, that
</p>
<p class="MsoPlainText">> works for me, it was a sign of bad/failed replication in my system I think (now fixed).</p>
<p class="MsoPlainText"> </p>
<p class="MsoNormal">I tried that using kpasswd and “ipa passwd” to change the password but neither solved the problem. In both cases I was able to run “kinit new-user” and set the credentials using the new password but new-user could not ssh in.</p>
<p class="MsoNormal"></p>
<p class="MsoNormal">It was a really strange problem. It looks like something got out of sync but I could not (and cannot) figure out where. It is doubly difficult because removing and re-adding the user worked. In addition, adding other users worked.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Regards,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Joe</p>
</div>
</div>
</div>
</div>
</body>
</html>