<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" style="display:none"></style> </head> <body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;"> <p>I've almost got AD integration going, except for the minor detail that no one can log in. When an AD user tries to SSH in to the IPA server, /var/log/secure shows:<br> </p> <p><br> </p> <p>------------------------------------------<br> </p> <div>Mar 18 13:59:08 genet sshd[21335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=tundra.middlebury.edu user=MIDD\guertin-s</div> <div>Mar 18 13:59:09 genet sshd[21335]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=tundra.middlebury.edu user=MIDD\guertin-s</div> <div>Mar 18 13:59:10 genet sshd[21335]: pam_sss(sshd:account): Access denied for user MIDD\guertin-s: 6 (Permission denied)</div> <div>Mar 18 13:59:10 genet sshd[21335]: Failed password for MIDD\\guertin-s from 140.233.6.66 port 59707 ssh2</div> <div>Mar 18 13:59:10 genet sshd[21335]: fatal: Access denied for user MIDD\\\\guertin-s by PAM account configuration [preauth]<br> </div> <p style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;">------------------------------------------<br> </p> <p><br> </p> <p>So pam_sss is responding with "permission denied". /etc/pam.d/password-auth contains:<br> </p> <p><br> </p> <div> <p style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;">------------------------------------------<br> </p> #%PAM-1.0</div> <div># This file is auto-generated.</div> <div># User changes will be destroyed the next time authconfig is run.</div> <div>auth required pam_env.so</div> <div>auth sufficient pam_unix.so nullok try_first_pass</div> <div>auth requisite pam_succeed_if.so uid >= 1000 quiet_success</div> <div>auth sufficient pam_sss.so use_first_pass</div> <div>auth required pam_deny.so</div> <div><br> </div> <div>account required pam_unix.so</div> <div>account sufficient pam_localuser.so</div> <div>account sufficient pam_succeed_if.so uid < 1000 quiet</div> <div>account [default=bad success=ok user_unknown=ignore] pam_sss.so</div> <div>account required pam_permit.so</div> <div><br> </div> <div>password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=</div> <div>password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok</div> <div>password sufficient pam_sss.so use_authtok</div> <div>password required pam_deny.so</div> <div><br> </div> <div>session optional pam_keyinit.so revoke</div> <div>session required pam_limits.so</div> <div>-session optional pam_systemd.so</div> <div>session optional pam_oddjob_mkhomedir.so umask=0077</div> <div>session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid</div> <div>session required pam_unix.so</div> <div>session optional pam_sss.so</div> <div> <p style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;">------------------------------------------<br> </p> <div><br> </div> <div>And with debug_level = 10, /var/log/sssd/sssd_pam.log shows:<br> <br> </div> <p style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;">------------------------------------------<br> </p> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_cmd_authenticate] (0x0100): entering pam_cmd_authenticate</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name 'MIDD\guertin-s' matched expression for domain 'middlebury.edu', user is guertin-s</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): domain: middlebury.edu</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): user: guertin-s</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): service: sshd</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): rhost: tundra.middlebury.edu</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): priv: 1</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 21335</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): logon name: MIDD\guertin-s</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/USER/middlebury.edu/guertin-s]</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [sss_dp_issue_request] (0x0400): Issuing request for [0x7fc92c76bed0:3:guertin-s@middlebury.edu]</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [sss_dp_get_account_msg] (0x0400): Creating request for [middlebury.edu][3][1][name=guertin-s]</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [sbus_add_timeout] (0x2000): 0x7fc92e921240</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [sss_dp_internal_get_send] (0x0400): Entering request [0x7fc92c76bed0:3:guertin-s@middlebury.edu]</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [sbus_remove_timeout] (0x2000): 0x7fc92e921240</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn: 0x7fc92e920450</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [sbus_dispatch] (0x4000): Dispatching.</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 0 errno: 0 error message: Success</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_check_user_search] (0x0100): Requesting info for [guertin-s@middlebury.edu]</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x7fc92e924ac0</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x7fc92e924bf0</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [ldb] (0x4000): Running timer event 0x7fc92e924ac0 "ltdb_callback"</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [ldb] (0x4000): Destroying timer event 0x7fc92e924bf0 "ltdb_timeout"</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [ldb] (0x4000): Ending timer event 0x7fc92e924ac0 "ltdb_callback"</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_check_user_search] (0x0400): Returning info for user [guertin-s@middlebury.edu]</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pd_set_primary_name] (0x0400): User's primary name is guertin-s@middlebury.edu</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_initgr_cache_set] (0x2000): [guertin-s@middlebury.edu] added to PAM initgroup cache</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending request with the following data:</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): domain: middlebury.edu</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): user: guertin-s@middlebury.edu</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): service: sshd</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): rhost: tundra.middlebury.edu</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): priv: 1</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 21335</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_print_data] (0x0100): logon name: MIDD\guertin-s</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [sbus_add_timeout] (0x2000): 0x7fc92e928530</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0</div> <div>(Wed Mar 18 13:59:08 2015) [sssd[pam]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x7fc92c76bed0:3:guertin-s@middlebury.edu]</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [sbus_remove_timeout] (0x2000): 0x7fc92e928530</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn: 0x7fc92e920450</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [sbus_dispatch] (0x4000): Dispatching.</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_dp_process_reply] (0x0100): received: [0][middlebury.edu]</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [0].</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [ldb] (0x4000): start ldb transaction (nesting: 0)</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x7fc92e9281b0</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x7fc92e928270</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [ldb] (0x4000): Running timer event 0x7fc92e9281b0 "ltdb_callback"</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [ldb] (0x4000): Destroying timer event 0x7fc92e928270 "ltdb_timeout"</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [ldb] (0x4000): Ending timer event 0x7fc92e9281b0 "ltdb_callback"</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [ldb] (0x4000): commit ldb transaction (nesting: 0)</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [0].</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_reply] (0x0200): blen: 79</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x7fc92e931f40][19]</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x7fc92e931f40][19]</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_cmd_acct_mgmt] (0x0100): entering pam_cmd_acct_mgmt</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name 'MIDD\guertin-s' matched expression for domain 'middlebury.edu', user is guertin-s</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_ACCT_MGMT</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_print_data] (0x0100): domain: middlebury.edu</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_print_data] (0x0100): user: guertin-s</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_print_data] (0x0100): service: sshd</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_print_data] (0x0100): rhost: tundra.middlebury.edu</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 0</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_print_data] (0x0100): priv: 1</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 21335</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [pam_print_data] (0x0100): logon name: MIDD\guertin-s</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/USER/middlebury.edu/guertin-s]</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [sss_dp_issue_request] (0x0400): Issuing request for [0x7fc92c76bed0:3:guertin-s@middlebury.edu]</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [sss_dp_get_account_msg] (0x0400): Creating request for [middlebury.edu][3][1][name=guertin-s]</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [sbus_add_timeout] (0x2000): 0x7fc92e929bc0</div> <div>(Wed Mar 18 13:59:09 2015) [sssd[pam]] [sss_dp_internal_get_send] (0x0400): Entering request [0x7fc92c76bed0:3:guertin-s@middlebury.edu]</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [sbus_remove_timeout] (0x2000): 0x7fc92e929bc0</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn: 0x7fc92e920450</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [sbus_dispatch] (0x4000): Dispatching.</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 0 errno: 0 error message: Success</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_check_user_search] (0x0100): Requesting info for [guertin-s@middlebury.edu]</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x7fc92e9249e0</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x7fc92e924b10</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [ldb] (0x4000): Running timer event 0x7fc92e9249e0 "ltdb_callback"</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [ldb] (0x4000): Destroying timer event 0x7fc92e924b10 "ltdb_timeout"</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [ldb] (0x4000): Ending timer event 0x7fc92e9249e0 "ltdb_callback"</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_check_user_search] (0x0400): Returning info for user [guertin-s@middlebury.edu]</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pd_set_primary_name] (0x0400): User's primary name is guertin-s@middlebury.edu</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_initgr_cache_set] (0x2000): [guertin-s@middlebury.edu] added to PAM initgroup cache</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending request with the following data:</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_ACCT_MGMT</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_print_data] (0x0100): domain: middlebury.edu</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_print_data] (0x0100): user: guertin-s@middlebury.edu</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_print_data] (0x0100): service: sshd</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh<br> </div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_print_data] (0x0100): rhost: tundra.middlebury.edu<br> </div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 0</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_print_data] (0x0100): priv: 1</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 21335</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_print_data] (0x0100): logon name: MIDD\guertin-s</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [sbus_add_timeout] (0x2000): 0x7fc92e936050</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x7fc92c76bed0:3:guertin-s@middlebury.edu]</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [sbus_remove_timeout] (0x2000): 0x7fc92e936050</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn: 0x7fc92e920450</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [sbus_dispatch] (0x4000): Dispatching.</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_dp_process_reply] (0x0100): received: [6][middlebury.edu]</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [6].</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [pam_reply] (0x0200): blen: 31</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x7fc92e931f40][19]</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x7fc92e931f40][19]</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [client_recv] (0x0200): Client disconnected!</div> <div>(Wed Mar 18 13:59:10 2015) [sssd[pam]] [client_destructor] (0x2000): Terminated client [0x7fc92e931f40][19]<br> </div> <p style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;">------------------------------------------<br> </p> <div><br> Everything looks normal here to me, until "[pam_dp_process_reply] (0x0100): received: [6]", after which the client disconnects. Can someone help with PAM configuration to get this to work?<br> </div> <div><br> </div> <div>As described in the documentation, my ad_users group contains the group ad_users_external, which contains the AD group rhidm_users:<br> </div> <div><br> </div> <div> <div># ipa group-show ad_users</div> <div> Group name: ad_users</div> <div> Description: AD users</div> <div> GID: 1447200005</div> <div> Member groups: ad_users_external</div> <div><br> <div># ipa group-show ad_users_external</div> <div> Group name: ad_users_external</div> <div> Description: AD users external map</div> <div> Member of groups: ad_users</div> <div> External member: rhidm_users@middlebury.edu<br> </div> <br> </div> David Guertin<br> </div> </div> <div id="Signature"> <div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0"> <br> </div> </div> </body> </html>