<div dir="ltr"><div>[root@freeipa ~]# ipa hbactest --user=myuser --host=my.fqdn. --service=sshd</div><div>--------------------</div><div>Access granted: True</div><div>--------------------</div><div> Matched rules: allow_all</div>
<div>[root@freeipa ~]# </div><div><br></div><div><br></div><div><div>└─> ssh <a href="mailto:myuserj@ec2-54-xxx.xxx.compute-1.amazonaws.com">myuserj@ec2-54-xxx.xxx.compute-1.amazonaws.com</a> -i /home/user/.ssh/key</div>
<div>Connection closed by 54x.x.x.x</div><div><br></div><div style>(client server logs)</div><div style>Apr 10 13:59:04 ip-10-152-174-17 sshd[22868]: pam_sss(sshd:account): Access denied for user myuser: 4 (System error)<br>
</div><div style><div>Apr 10 13:59:04 ip-10-152-174-17 sshd[22872]: fatal: Access denied for user client by PAM account configuration</div><div style><br></div><div style><br></div><div style>(client ipa versions)</div><div style>
<div>ipa-admintools-3.0.0-26.el6_4.2.x86_64</div><div>ipa-client-3.0.0-26.el6_4.2.x86_64</div><div>ipa-python-3.0.0-26.el6_4.2.x86_64 </div><div><br></div></div><div style><br></div><div style>(master ipa versions)</div></div>
<div><div>[root@freeipa ~]# rpm -qa |grep ipa-</div><div><br></div><div>ipa-pki-common-theme-9.0.3-7.el6.noarch</div><div>ipa-pki-ca-theme-9.0.3-7.el6.noarch</div><div>ipa-client-3.0.0-26.el6_4.2.x86_64</div><div>ipa-python-3.0.0-26.el6_4.2.x86_64</div>
<div>ipa-admintools-3.0.0-26.el6_4.2.x86_64</div><div>ipa-server-selinux-3.0.0-26.el6_4.2.x86_64</div><div>ipa-server-3.0.0-26.el6_4.2.x86_64</div><div>[root@freeipa ~]# </div></div></div><div><br></div><div><br></div></div>
<div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Apr 4, 2013 at 5:06 PM, KodaK <span dir="ltr"><<a href="mailto:sakodak@gmail.com" target="_blank">sakodak@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Run an hbactest:<div><br></div><div>ipa hbactest --user=youruser --host=fqdn.of.host --service=sshd</div><div><br></div><div>Make sure that works, if it does, then you can move on to troubleshooting the host itself.</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote"><div class="im">On Thu, Apr 4, 2013 at 2:27 PM, Shawn <span dir="ltr"><<a href="mailto:taaj.shawn@gmail.com" target="_blank">taaj.shawn@gmail.com</a>></span> wrote:<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div dir="ltr">Hi,<div><br></div><div>I have configured a ipa-server, replica and client.</div>
<div><br></div><div>In the GUI I can see that all hosts are in the "hosts" list.. I have created a single user as well and attached that user to the client.</div>
<div><br></div><div>When trying to login as the user to the client, I see this in the secure.log.<br clear="all"><div><br></div><div>fatal: Access denied for user <username> by PAM account configuration.<br></div><div>
<br></div><div>any suggestions on steps to troubleshoot this?</div><div><br></div><div>Thanks</div><span><font color="#888888"><div><br></div><div><br></div>-- <br><b><i>- Shawn Taaj</i></b><br>
</font></span></div></div>
<br></div></div><div class="im">_______________________________________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br></div></blockquote></div><span class="HOEnZb"><font color="#888888"><br><br clear="all">
<div><br></div>-- <br>The government is going to read our mail anyway, might as well make it tough for them. GPG Public key ID: B6A1A7C6
</font></span></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><b><i>- Shawn Taaj</i></b><br>
</div>