<br><br><div class="gmail_quote">On Thu, Sep 27, 2012 at 10:53 AM, David Sastre <span dir="ltr"><<a href="mailto:d.sastre.medina@gmail.com" target="_blank">d.sastre.medina@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div class="gmail_quote"><div class="im">On Thu, Sep 27, 2012 at 10:01 AM, Jakub Hrozek wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="im"> On Thu, Sep 27, 2012 at 08:18:21AM +0200, David Sastre wrote:<br></div><div class="im"> > On Wed, Sep 26, 2012 at 11:08 PM, David Sastre Medina wrote:<br> > > On Wed, Sep 26, 2012 at 03:06:40PM -0400, Rob Crittenden wrote:<br> > > > David Sastre wrote:<br> > > > > [big snip]<br> > > > Does sssd work on this machine otherwise? getent passwd <foo>, you<br> > > > can log into the console as the user, or perhaps kinit to the user?<br> > ><br> > It looks like sssd is operating correctly<br></div><div class="im"> > I can also kinit w/o problems:<br> <br> </div></div><div class="im">kinit bypasses the SSSD and talks to the KDC directly.<br> <div> </div></div><div class="im">...however, the ssh should go through the SSSD...<br> <div><br> </div></div><div class="im">Can you check the messages that appear in /var/log/secure during the<br> sudo auth attempt? You should see pam_sss being contacted, what does it<br> say? Is there any error?<br></div></blockquote><div><br>Jakub,<br><br>Does your comment mean ssh/sshd is misbehaving or bad configured?<br><br>There are, indeed, errors regarding pam_sss in /var/log/secure. <br><br>This is a successful login+sudo+logout in a host:<br> <br>Sep 27 10:29:56 panoramix sshd[12913]: Authorized to dsastrem, krb5 principal <a href="mailto:dsastrem@SOME.DOMAIN.COM" target="_blank">dsastrem@SOME.DOMAIN.COM</a> (krb5_kuserok)<br>Sep 27 10:29:56 panoramix sshd[12913]: Accepted gssapi-with-mic for dsastrem from 172.26.130.101 port 58678 ssh2<br> Sep 27 10:29:56 panoramix sshd[12913]: pam_unix(sshd:session): session opened for user dsastrem by (uid=0)<br>Sep 27 10:30:13 panoramix sudo: pam_unix(sudo:auth): authentication failure; logname=dsastrem uid=0 euid=0 tty=/dev/pts/2 ruser=dsastrem rhost= user=dsastrem<br> Sep 27 10:30:13 panoramix sudo: pam_sss(sudo:auth): authentication success; logname=dsastrem uid=0 euid=0 tty=/dev/pts/2 ruser=dsastrem rhost= user=dsastrem<br>Sep 27 10:30:13 panoramix sudo: dsastrem : TTY=pts/2 ; PWD=/home/dsastrem ; USER=root ; COMMAND=/sbin/ip addr show<br> Sep 27 10:30:32 panoramix sshd[12942]: Received disconnect from <a href="http://172.26.130.101" target="_blank">172.26.130.101</a>: 11: disconnected by user<br>Sep 27 10:30:32 panoramix sshd[12913]: pam_unix(sshd:session): session closed for user dsastrem<br> <br>This one a failed attempt to do the same in another host:<br><br>Sep 27 10:32:27 obelix sshd[5242]: Authorized to dsastrem, krb5 principal <a href="mailto:dsastrem@SOME.DOMAIN.COM" target="_blank">dsastrem@SOME.DOMAIN.COM</a> (krb5_kuserok)<br> Sep 27 10:32:27 obelix sshd[5242]: Accepted gssapi-with-mic for dsastrem from 172.26.130.101 port 38276 ssh2<br>Sep 27 10:32:27 obelix sshd[5242]: pam_unix(sshd:session): session opened for user dsastrem by (uid=0)<br>Sep 27 10:32:50 obelix sudo: pam_unix(sudo:auth): authentication failure; logname=dsastrem uid=0 euid=0 tty=/dev/pts/1 ruser=dsastrem rhost= user=dsastrem<br> Sep 27 10:32:50 obelix sudo: pam_sss(sudo:auth): system info: [Permission denied]<br>Sep 27 10:32:50 obelix sudo: pam_sss(sudo:auth): authentication failure; logname=dsastrem uid=0 euid=0 tty=/dev/pts/1 ruser=dsastrem rhost= user=dsastrem<br> Sep 27 10:32:50 obelix sudo: pam_sss(sudo:auth): received for user dsastrem: 4 (System error)<br>Sep 27 10:33:13 obelix sudo: pam_unix(sudo:auth): conversation failed<br>Sep 27 10:33:13 obelix sudo: pam_unix(sudo:auth): auth could not identify password for [dsastrem]<br> Sep 27 10:33:13 obelix sudo: pam_sss(sudo:auth): system info: [Cannot read password]<br>Sep 27 10:33:13 obelix sudo: pam_sss(sudo:auth): authentication failure; logname=dsastrem uid=0 euid=0 tty=/dev/pts/1 ruser=dsastrem rhost= user=dsastrem<br> Sep 27 10:33:13 obelix sudo: pam_sss(sudo:auth): received for user dsastrem: 4 (System error)<br>Sep 27 10:33:13 obelix sudo: dsastrem : 1 incorrect password attempt ; TTY=pts/1 ; PWD=/home/dsastrem ; USER=root ; COMMAND=/sbin/ip addr show<br> Sep 27 10:33:21 obelix sshd[5281]: Received disconnect from <a href="http://172.26.130.101" target="_blank">172.26.130.101</a>: 11: disconnected by user<br>Sep 27 10:33:21 obelix sshd[5242]: pam_unix(sshd:session): session closed for user dsastrem<br> <br>I can see now where it is failing, but I can't understand why (yet), is this PAM related? <br></div></div> </blockquote></div><br>For the record, and just in case it's useful for others, I solved this. These were the steps taken:<br><br>- add debug_level = 10 to /etc/sssd/sssd.config<br>- ssh to user and issue a sudo command<br> - /var/log/sssd/krb5_child.log snippet:<br><br> 1 (Tue Oct 2 10:13:07 2012) [[sssd[krb5_child[28605]]]] [krb5_child_setup] (0x1000): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.<br> 2 (Tue Oct 2 10:13:07 2012) [[sssd[krb5_child[28605]]]] [krb5_child_setup] (0x1000): Cannot read [SSSD_KRB5_LIFETIME] from environment.<br> 3 (Tue Oct 2 10:13:07 2012) [[sssd[krb5_child[28605]]]] [krb5_child_setup] (0x4000): Not using FAST.<br> 4 (Tue Oct 2 10:13:07 2012) [[sssd[krb5_child[28605]]]] [validate_tgt] (0x4000): Found keytab entry with the realm of the credential.<br> 5 (Tue Oct 2 10:13:07 2012) [[sssd[krb5_child[28605]]]] [validate_tgt] (0x0200): TGT verified using key for [host/<a href="mailto:obelix.some.domain.com@SOME.DOMAIN.COM">obelix.some.domain.com@SOME.DOMAIN.COM</a>].<br> 6 (Tue Oct 2 10:13:07 2012) [[sssd[krb5_child[28605]]]] [become_user] (0x4000): Trying to become user [1543400001][1543400001].<br> 7 (Tue Oct 2 10:13:07 2012) [[sssd[krb5_child[28605]]]] [create_ccache_file] (0x0020): mkstemp failed [13][Permission denied].<br> 8 (Tue Oct 2 10:13:07 2012) [[sssd[krb5_child[28605]]]] [get_and_save_tgt] (0x0020): 688: [13][Permission denied]<br> 9 (Tue Oct 2 10:13:07 2012) [[sssd[krb5_child[28605]]]] [tgt_req_child] (0x0020): 919: [13][Permission denied]<br> <br>- verify no AVC denials exist in /var/log/audit/audit.log:<br><br>12 type=SYSCALL msg=audit(1349166186.421:6931172): arch=c000003e syscall=2 success=no exit=-13 a0=6235f0 a1=c2 a2=180 a3=7fff58d80dc0 items=1 ppid=28558 pid=30842 auid=500 uid=1543400001 gid=15 43400001 euid=1543400001 suid=1543400001 fsuid=1543400001 egid=1543400001 sgid=1543400001 fsgid=1543400001 tty=(none) ses=17963 comm="krb5_child" exe="/usr/libexec/sssd/krb5_child" subj=unco nfined_u:system_r:sssd_t:s0 key="access"<br> 13 type=PATH msg=audit(1349166186.421:6931172): item=0 name="/tmp/.krb5cc_dummy_hiA8y9" inode=131104 dev=fd:15 mode=040757 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0<br> 14 type=USER_AUTH msg=audit(1349166187.601:6931173): user pid=30807 uid=0 auid=1543400001 ses=17969 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="dsastrem" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/2 res=failed'<br> <br>- google a bit (<a href="http://www.mail-archive.com/sssd-devel@lists.fedorahosted.org/msg10176.html">http://www.mail-archive.com/sssd-devel@lists.fedorahosted.org/msg10176.html</a>)<br>- restore expected /tmp permissions:<br> <br># ll -dZ /tmp/<br>drwxr-xrwx. root root system_u:object_r:tmp_t:s0 /tmp/<br># chmod g+w,o+t /tmp/<br># ll -dZ /tmp/<br>drwxrwxrwt. root root system_u:object_r:tmp_t:s0 /tmp/<br><br>sudo works correctly again, thanks to the people in this list who spend time looking into this and pointed me in the right direction.<br>