<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8"> <META NAME="GENERATOR" CONTENT="GtkHTML/4.6.6"> </HEAD> <BODY> On Wed, 2013-09-11 at 08:27 -0500, Dean Hunter wrote: <BLOCKQUOTE TYPE=CITE> On Wed, 2013-09-11 at 07:10 +0300, Alexander Bokovoy wrote: <BLOCKQUOTE TYPE=CITE> <PRE> Hi Dean, On Tue, 10 Sep 2013, Dean Hunter wrote: >How do I determine the cause of this problem? > > [dean@ipa2 ~]$ ssh dean@desktop2 > Last login: Tue Sep 10 21:10:01 2013 from ipa2.hunter.org > Could not chdir to home directory /home/net/dean: Permission > denied > -bash: /home/net/dean/.bash_profile: Permission denied > > -bash-4.2$ rpm -q freeipa-client > freeipa-client-3.1.5-1.fc18.x86_64 > -bash-4.2$ > >I can log in as dean on desktop2 using gdm without a problem. But when >I try to log in using ssh then I am denied access to the user's home >directory. Is there any SELinux AVC in the logs? Is /home/net an NFS mount? Does use_nfs_home_dirs SELinux boolean set to on? (getsebool -a|grep home) </PRE> </BLOCKQUOTE> 1) Is there any SELinux AVC in the logs? <BLOCKQUOTE> <TT>[<A HREF="mailto:dean@desktop2">dean@desktop2</A> ~]$ sudo ausearch --message avc</TT> <TT><no matches></TT> </BLOCKQUOTE> 2) Is /home/net an NFS mount? Yes 3) Is use_nfs_home_dirs SELinux boolean set to on? <BLOCKQUOTE> <TT>[<A HREF="mailto:dean@desktop2">dean@desktop2</A> ~]$ getsebool use_nfs_home_dirs</TT> <TT>use_nfs_home_dirs --> on</TT> </BLOCKQUOTE> Here is the script I use to configure IPA NFS clients: <BLOCKQUOTE> <TT># Configure the Network File System client</TT> <TT> setsebool -P use_nfs_home_dirs on</TT> <TT> cat /usr/lib/systemd/system/nfs-secure.service \</TT> <TT> | sed -e s/WantedBy=nfs.target/WantedBy=multi-user.target/ \</TT> <TT> > /etc/systemd/system/nfs-secure.service # RedHat bug 972363</TT> <TT> ipa-client-automount \\</TT> <TT> --location VM \\</TT> <TT> --unattended</TT> <TT> sed -i 's/sss files/ files sss/g' /etc/nsswitch.conf # FreeIPA bug 3733</TT> <TT> systemctl restart sssd.service # FreeIPA bug 3733</TT> <TT> systemctl restart autofs.service # FreeIPA bug 3733</TT> </BLOCKQUOTE> <PRE> _______________________________________________ Freeipa-users mailing list <A HREF="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</A> <A HREF="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</A> </PRE> </BLOCKQUOTE> I do NOT believe this: <BLOCKQUOTE> <TT>[<A HREF="mailto:dean@ipa2">dean@ipa2</A> ~]$ ssh <A HREF="mailto:dean@desktop2">dean@desktop2</A></TT> <TT>Last login: Wed Sep 11 08:32:21 2013 from ipa2.hunter.org</TT> <TT>Could not chdir to home directory /home/net/dean: Permission denied</TT> <TT>-bash: /home/net/dean/.bash_profile: Permission denied</TT> <TT>-bash-4.2$ logout</TT> <TT>-bash: /home/net/dean/.bash_logout: Permission denied</TT> <TT>Connection to desktop2 closed.</TT> <TT>[<A HREF="mailto:dean@ipa2">dean@ipa2</A> ~]$ su -</TT> <TT>Password: </TT> <TT>[<A HREF="mailto:root@ipa2">root@ipa2</A> ~]# ssh <A HREF="mailto:dean@desktop2">dean@desktop2</A></TT> <TT><A HREF="mailto:dean@desktop2">dean@desktop2</A>'s password: </TT> <TT>Last login: Wed Sep 11 08:34:29 2013 from ipa2.hunter.org</TT> <TT>[<A HREF="mailto:dean@desktop2">dean@desktop2</A> ~]$ logout</TT> <TT>Connection to desktop2 closed.</TT> <TT>[<A HREF="mailto:root@ipa2">root@ipa2</A> ~]# logout</TT> <TT>[<A HREF="mailto:dean@ipa2">dean@ipa2</A> ~]$ ssh <A HREF="mailto:dean@desktop2">dean@desktop2</A></TT> <TT>Last login: Wed Sep 11 08:35:16 2013 from ipa2.hunter.org</TT> <TT>[<A HREF="mailto:dean@desktop2">dean@desktop2</A> ~]$ </TT> </BLOCKQUOTE> </BODY> </HTML>