<html> <head> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> Thanks for the reply, I did not clear out /var/lib/sss/db before re-installation. I'll give it a try. I'll stop the service clear the db then restart and see if that helps. If not I'll uninstall the client remove the db and then reinstall the client. Unless it's too late and anyone has a better idea. -Chris <div class="moz-cite-prefix">On 8/20/2015 7:19 PM, Prasun Gera wrote: </div> <blockquote cite="mid:CAFLz+B=4pa4V83pi0=cMsaTUZDtfXdA3bQG-Wb3=F91U0=j+YA@mail.gmail.com" type="cite"> <div dir="ltr">Did you clear out /var/lib/sss/db between re-installation of the client? There was a bug which might not have been fixed downstream yet. </div> <div class="gmail_extra"> <div class="gmail_quote">On Thu, Aug 20, 2015 at 1:21 PM, Chris Mohler <<a moz-do-not-send="true" href="mailto:cmohler@oberlin.edu" target="_blank">cmohler@oberlin.edu</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div text="#000000" bgcolor="#FFFFFF"> Hi List, I'm still fairly new to this list and administrating FreeIPA. I had a very old version of freeipa and had all sorts of odd issues with it. I had 47 ubuntu clients attached to the domain. I setup a newer freeipa server version: 4.1.4 I recreated all my user accounts by hand I did not migrate any of them. I then removed the 47 clients from the old domain #ipa-client-install --uninstall Then I reinstalled each client #ipa-client-install --domain=<a moz-do-not-send="true" href="http://cs.oberlin.edu" target="_blank">cs.oberlin.edu</a> --realm=<a moz-do-not-send="true" href="http://CS.OBERLIN.EDU" target="_blank">CS.OBERLIN.EDU</a> -p admin -W --hostname `hostname` -N it finished without errors on all my systems. two of my systems will not let any ipa users login via ssh or the console. the rest of them work fine. After keying in the password I get the following. Permission denied, please try again. id (username) shows the UID and GID and Groups correctly. getent passwd shows only my local accounts I don't have enumerate on. kinit also works. my auth.log shows this pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.162.201.237 user=HIDDEN pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.162.201.237 user=HIDDEN pam_sss(sshd:auth): received for user : 7 (Authentication failure) I know it's the correct password as it works on the other clients. I get this in krb5_child.log [[sssd[krb5_child[10546]]]] [unpack_buffer] (0x0100): cmd [241] uid [66133] gid [100] validate [true] enterprise principal [false] offline [false] UPN [@<a moz-do-not-send="true" href="http://CS.OBERLIN.EDU" target="_blank">CS.OBERLIN.EDU</a>] (Tue Aug 18 10:46:28 2015) [[sssd[krb5_child[10546]]]] [unpack_buffer] (0x0100): ccname: [<a moz-do-not-send="true"><a class="moz-txt-link-freetext" href="FILE:/tmp/krb5cc_66133_XXXXXX">FILE:/tmp/krb5cc_66133_XXXXXX</a></a>] keytab: [/etc/krb5.keytab] (Tue Aug 18 10:46:28 2015) [[sssd[krb5_child[10546]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment. (Tue Aug 18 10:46:28 2015) [[sssd[krb5_child[10546]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment. (Tue Aug 18 10:46:28 2015) [[sssd[krb5_child[10546]]]] [set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to [true] (Tue Aug 18 10:46:28 2015) [[sssd[krb5_child[10546]]]] [k5c_setup_fast] (0x0100): SSSD_KRB5_FAST_PRINCIPAL is set to [<a moz-do-not-send="true" href="mailto:host/occs.cs.oberlin.edu@CS.OBERLIN.EDU" target="_blank">host/occs.cs.oberlin.edu@CS.OBERLIN.EDU</a>] (Tue Aug 18 10:46:28 2015) [[sssd[krb5_child[10546]]]] [match_principal] (0x1000): Principal matched to the sample (<a moz-do-not-send="true" href="mailto:host/occs.cs.oberlin.edu@CS.OBERLIN.EDU" target="_blank">host/occs.cs.oberlin.edu@CS.OBERLIN.EDU</a>). (Tue Aug 18 10:46:28 2015) [[sssd[krb5_child[10546]]]] [check_fast_ccache] (0x0200): FAST TGT is still valid. (Tue Aug 18 10:46:28 2015) [[sssd[krb5_child[10546]]]] [main] (0x0400): Will perform online auth (Tue Aug 18 10:46:28 2015) [[sssd[krb5_child[10546]]]] [tgt_req_child] (0x1000): Attempting to get a TGT (Tue Aug 18 10:46:28 2015) [[sssd[krb5_child[10546]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [<a moz-do-not-send="true" href="http://CS.OBERLIN.EDU" target="_blank">CS.OBERLIN.EDU</a>] (Tue Aug 18 10:46:28 2015) [[sssd[krb5_child[10546]]]] [validate_tgt] (0x0400): TGT verified using key for [<a moz-do-not-send="true" href="mailto:host/occs.cs.oberlin.edu@CS.OBERLIN.EDU" target="_blank"><a class="moz-txt-link-abbreviated" href="mailto:host/occs.cs.oberlin.edu@CS.OBERLIN.EDU">host/occs.cs.oberlin.edu@CS.OBERLIN.EDU</a></a>]. (Tue Aug 18 10:46:28 2015) [[sssd[krb5_child[10546]]]] [become_user] (0x0200): Trying to become user [66133][100]. (Tue Aug 18 10:46:28 2015) [[sssd[krb5_child[10546]]]] [k5c_send_data] (0x0200): Received error code 0 (Tue Aug 18 10:46:28 2015) [[sssd[krb5_child[10546]]]] [main] (0x0400): krb5_child completed successfully (Tue Aug 18 10:50:20 2015) [[sssd[krb5_child[10616]]]] [main] (0x0400): krb5_child started. (Tue Aug 18 10:50:20 2015) [[sssd[krb5_child[10616]]]] [unpack_buffer] (0x1000): total buffer size: [127] (Tue Aug 18 10:50:20 2015) [[sssd[krb5_child[10616]]]] [unpack_buffer] (0x0100): cmd [241] uid [66133] gid [100] validate [true] enterprise principal [false] offline [false] UPN [@<a moz-do-not-send="true" href="http://CS.OBERLIN.EDU" target="_blank">CS.OBERLIN.EDU</a>] sssd.conf on the broken machine [domain/<a moz-do-not-send="true" href="http://cs.oberlin.edu" target="_blank">cs.oberlin.edu</a>] debug_level=8 cache_credentials = True krb5_store_password_if_offline = True ipa_domain = <a moz-do-not-send="true" href="http://cs.oberlin.edu" target="_blank">cs.oberlin.edu</a> id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = <a moz-do-not-send="true" href="http://occs.cs.oberlin.edu" target="_blank">occs.cs.oberlin.edu</a> chpass_provider = ipa ipa_server = _srv_, <a moz-do-not-send="true" href="http://ipa1.cs.oberlin.edu" target="_blank">ipa1.cs.oberlin.edu</a> ldap_tls_cacert = /etc/ipa/ca.crt [sssd] services = nss, pam, ssh config_file_version = 2 debug_level=8 domains = <a moz-do-not-send="true" href="http://cs.oberlin.edu" target="_blank">cs.oberlin.edu</a> [nss] debug_level=8 [pam] debug_level=8 [sudo] [autofs] [ssh] debug_level=8 [pac] The broken systems sssd_nss.log [nss_cmd_getpwnam_search] (0x0400): Returning info for user [<a moz-do-not-send="true" href="mailto:HIDDEN@cs.oberlin.edu" target="_blank">HIDDEN@cs.oberlin.edu</a>] [sssd[nss]] [nss_cmd_getbynam] (0x0400): Running command [17] with input [HIDDEN]. [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name 'HIDDEN' matched without domain, user is HIDDEN [sssd[nss]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)] [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for [HIDDEN] from [<ALL>] [sssd[nss]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/USER/<a moz-do-not-send="true" href="http://cs.oberlin.edu/HIDDEN" target="_blank">cs.oberlin.edu/HIDDEN</a>] [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): Requesting info for [<a moz-do-not-send="true" href="mailto:HIDDEN@cs.oberlin.edu" target="_blank">HIDDEN@cs.oberlin.edu</a>] [sssd[nss]] [check_cache] (0x0400): Cached entry is valid, returning.. Any suggestions on how I can get users to login to this machine? Thanks, -Chris </div> -- Manage your subscription for the Freeipa-users mailing list: <a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> Go to <a moz-do-not-send="true" href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project </blockquote> </div> </div> </blockquote> </body> </html>