<html><body><div style="color:#000; background-color:#fff; font-family:lucida console, sans-serif;font-size:16px"><div dir="ltr" id="yui_3_16_0_1_1415993917914_10026"><span id="yui_3_16_0_1_1415993917914_10030">I have one other possibly related question though. I also get access denied errors in the logs for local service accounts running crons or other services on my IPA client servers: <br></span></div><div id="yui_3_16_0_1_1415993917914_10058" dir="ltr"><span id="yui_3_16_0_1_1415993917914_10030"><br></span></div><div id="yui_3_16_0_1_1415993917914_10060" dir="ltr"><span style="" class="" id="yui_3_16_0_1_1415993917914_10030">pam_sss(crond:account):Access denied for user </span><span id="yui_3_16_0_1_1415993917914_10030"><span style="" class="" id="yui_3_16_0_1_1415993917914_10030"><i style="" class="" id="yui_3_16_0_1_1415993917914_10059">username</i></span>: 10 (User not known to the underlying authentication module)<br style="" class=""></span></div><div id="yui_3_16_0_1_1415993917914_10102" dir="ltr"><span id="yui_3_16_0_1_1415993917914_10030"><br></span></div><div id="yui_3_16_0_1_1415993917914_10103" dir="ltr"><span id="yui_3_16_0_1_1415993917914_10030">pam_sss(sshd:account): Access denied for user <i id="yui_3_16_0_1_1415993917914_10059">username</i>: 10 (User not known to the underlying authentication module)</span></div><div id="yui_3_16_0_1_1415993917914_10166" dir="ltr"><br><span id="yui_3_16_0_1_1415993917914_10030"></span></div><div id="yui_3_16_0_1_1415993917914_10167" dir="ltr"><span style="" class="" id="yui_3_16_0_1_1415993917914_10030">su: pam_sss(su-l:account): Access denied for user </span><span id="yui_3_16_0_1_1415993917914_10030"><span style="" class="" id="yui_3_16_0_1_1415993917914_10030"><i style="" class="" id="yui_3_16_0_1_1415993917914_10059">username</i></span>: 10 (User not known to the underlying authentication module)<br style="" class=""></span></div><div id="yui_3_16_0_1_1415993917914_10063" dir="ltr"><br><span id="yui_3_16_0_1_1415993917914_10030"></span></div><div id="yui_3_16_0_1_1415993917914_10084" dir="ltr"><span id="yui_3_16_0_1_1415993917914_10030">These crons still run but errors fill the logs. SInce I can't add an external user to an HBAC rule I am not sure how to rectify</span></div><br> <div id="yui_3_16_0_1_1415993917914_10033" style="font-family: lucida console, sans-serif; font-size: 16px;"> <div id="yui_3_16_0_1_1415993917914_10032" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div id="yui_3_16_0_1_1415993917914_10031" dir="ltr"> <hr id="yui_3_16_0_1_1415993917914_10046" size="1"> <font id="yui_3_16_0_1_1415993917914_10040" face="Arial" size="2"> <b id="yui_3_16_0_1_1415993917914_10178"><span id="yui_3_16_0_1_1415993917914_10177" style="font-weight:bold;">From:</span></b> Justean <justeank@yahoo.com><br> <b><span style="font-weight: bold;">To:</span></b> Rob Crittenden <rcritten@redhat.com>; "freeipa-users@redhat.com" <freeipa-users@redhat.com> <br> <b id="yui_3_16_0_1_1415993917914_10180"><span id="yui_3_16_0_1_1415993917914_10179" style="font-weight: bold;">Sent:</span></b> Friday, November 14, 2014 12:24 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] user can't run crons after setting rhel 5 servers as ipa client<br> </font> </div> <div id="yui_3_16_0_1_1415993917914_10034" class="y_msg_container"><br><div id="yiv9961440493"><div id="yui_3_16_0_1_1415993917914_10036"><div id="yui_3_16_0_1_1415993917914_10035" style="color:#000;background-color:#fff;font-family:lucida console, sans-serif;font-size:16px;"><div dir="ltr" id="yiv9961440493yui_3_16_0_1_1415993917914_5558">Ahh, I got you. We do use hbac rules, I did not think I need to add crond as a service to allow because it isn't even in the list of services available but I see that I do have to just manually add the service. Thank you, it is working now<br clear="none"></div><div id="yiv9961440493yui_3_16_0_1_1415993917914_5557"><span></span></div><br clear="none"> <div class="qtdSeparateBR"><br><br></div><div class="yiv9961440493yqt3472241303" id="yiv9961440493yqt79907"><div id="yiv9961440493yui_3_16_0_1_1415993917914_5554" style="font-family:lucida console, sans-serif;font-size:16px;"> <div id="yiv9961440493yui_3_16_0_1_1415993917914_5553" style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;"> <div dir="ltr" id="yiv9961440493yui_3_16_0_1_1415993917914_5556"> <hr id="yiv9961440493yui_3_16_0_1_1415993917914_5577" size="1"> <font id="yiv9961440493yui_3_16_0_1_1415993917914_5555" face="Arial" size="2"> <b><span style="font-weight:bold;">From:</span></b> Rob Crittenden <rcritten@redhat.com><br clear="none"> <b><span style="font-weight:bold;">To:</span></b> Justean <justeank@yahoo.com>; "freeipa-users@redhat.com" <freeipa-users@redhat.com> <br clear="none"> <b><span style="font-weight:bold;">Sent:</span></b> Friday, November 14, 2014 11:43 AM<br clear="none"> <b><span style="font-weight:bold;">Subject:</span></b> Re: [Freeipa-users] user can't run crons after setting rhel 5 servers as ipa client<br clear="none"> </font> </div> <div class="yiv9961440493y_msg_container" id="yiv9961440493yui_3_16_0_1_1415993917914_5552"><br clear="none">Justean wrote:<div id="yui_3_16_0_1_1415993917914_10037" class="yiv9961440493qtdSeparateBR"><br clear="none"><br clear="none"></div><div class="yiv9961440493yqt3503686993" id="yiv9961440493yqtfd00147"><br clear="none">> Our Redhat 5.10 servers that were moved into our IPA domain cannot run<br clear="none">> any IPA user's crons we can't even list the crons:<br clear="none">> <br clear="none">> crontab -l "you (/username/) are not allowed to access to (crontab)<br clear="none">> because of pam configuration"<br clear="none">> <br clear="none">> I don't know if I should be manually editing the<br clear="none">> /etc/pam.d/system-auth-ac and/or /etc/pam.d/crond to get this working<br clear="none">> and if so what I should put for the config.<br clear="none">> <br clear="none">> The client version is ipa-client-2.1.3-7.el5.x86_64 and the server<br clear="none">> version is ipa-server-3.0.0-42.el6.x86_64</div><br clear="none"><br clear="none">I would suspect this is due to HBAC. Do you use the HBAC feature?<br clear="none">Perhaps you need to add rules for these hosts.<br clear="none"><br clear="none">rob<div class="yiv9961440493yqt3503686993" id="yiv9961440493yqtfd34109"><br clear="none"><br clear="none"></div><br clear="none"><br clear="none"></div> </div> </div></div> </div></div></div><br><br></div> </div> </div> </div></body></html>