<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-AU" link="blue" vlink="purple"> <div class="WordSection1"> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">As an add on, I’ve upgraded our Xen template to 6.6 and run up a new VM using that and it attaches to the IPA environment perfectly well, so I’m guessing it is an issue with the upgrade scripts.<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p> <p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Best regards<o:p></o:p></span></p> <p class="MsoNormal"><b><span lang="EN-US" style="font-size:18.0pt;font-family:"Arial",sans-serif;color:#003859">David Taylor</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D"><br> <br> </span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p></o:p></span></p> <p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Michael Lasevich [mailto:mlasevich@gmail.com] <br> <b>Sent:</b> Friday, 7 November 2014 4:00 PM<br> <b>To:</b> Jakub Hrozek<br> <b>Cc:</b> David Taylor; freeipa-users@redhat.com<br> <b>Subject:</b> Re: [Freeipa-users] Centos IPA Client fails after upgrade to 6.6<o:p></o:p></span></p> <p class="MsoNormal"><o:p> </o:p></p> <div> <p class="MsoNormal">I am seeing somewhat similar behavior once upgrading from sssd 1.9 to 1.11 (centos 6.5 to 6.6)<o:p></o:p></p> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">I seem to be able to log in via ssh, but when I use http pam service, I get inconsistent behavior - seems like sometimes it works and others it errors out (success and failure can happen within a second)<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">In the logs I see things like:<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">[sssd[krb5_child[15410]]]: Internal credentials cache error<o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">and <o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">authentication failure; logname= uid=48 euid=48 tty= ruser= rhost= user=username<br> received for user username: 4 (System error)<o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Nothing in the audit.log that I can see<o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I am guessing this is an sssd issue but I am hoping someone here knows how to deal with it.<o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">IN case it matters - here is the pam config:<o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">auth required pam_env.so<br> auth sufficient pam_sss.so<br> auth required pam_deny.so<o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">account [default=bad success=ok user_unknown=ignore] pam_sss.so<br> account required pam_permit.so<o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">password requisite pam_cracklib.so try_first_pass retry=3 type=<br> password sufficient pam_sss.so use_authtok<br> password required pam_deny.so<o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><o:p> </o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">session optional pam_keyinit.so revoke<br> session required pam_limits.so<br> session optional pam_oddjob_mkhomedir.so<br> session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid<br> session optional pam_sss.so<o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">-M<o:p></o:p></p> </div> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> <div> <p class="MsoNormal">On Wed, Nov 5, 2014 at 1:05 AM, Jakub Hrozek <<a href="mailto:jhrozek@redhat.com" target="_blank">jhrozek@redhat.com</a>> wrote:<o:p></o:p></p> <blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm"> <div> <div> <p class="MsoNormal" style="margin-bottom:12.0pt">On Wed, Nov 05, 2014 at 02:30:55AM +0000, David Taylor wrote:<br> > Thanks for the reply. The PAM file is pretty stock for a centos build<br> ><br> > #%PAM-1.0<br> > # This file is auto-generated.<br> > # User changes will be destroyed the next time authconfig is run.<br> > auth required pam_env.so<br> > auth sufficient pam_unix.so nullok try_first_pass<br> > auth requisite pam_succeed_if.so uid >= 500 quiet<br> > auth sufficient pam_sss.so use_first_pass<br> > auth required pam_deny.so<br> ><br> > account required pam_unix.so<br> > account sufficient pam_localuser.so<br> > account sufficient pam_succeed_if.so uid < 500 quiet<br> > account [default=bad success=ok user_unknown=ignore] pam_sss.so<br> > account required pam_permit.so<br> ><br> > password requisite pam_cracklib.so try_first_pass retry=3 type=<br> > password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok<br> > password sufficient pam_sss.so use_authtok<br> > password required pam_deny.so<br> ><br> > session optional pam_keyinit.so revoke<br> > session required pam_limits.so<br> > session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid<br> > session required pam_unix.so<br> > session optional pam_sss.so<br> ><br> ><br> > Best regards<br> > David Taylor<o:p></o:p></p> </div> </div> <p class="MsoNormal">OK, so pam_sss is there ...<br> <br> And yet you see no mention of pam_sss.so in /var/log/secure ?<br> <br> Is this the file that was included from the service-specific PAM<br> configuration?<o:p></o:p></p> <div> <div> <p class="MsoNormal"><br> --<br> Manage your subscription for the Freeipa-users mailing list:<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br> Go To <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project<o:p></o:p></p> </div> </div> </blockquote> </div> <p class="MsoNormal"><o:p> </o:p></p> </div> </div> </body> </html>