<div dir="ltr"><div><div><div><div><div>this is what I have in /var/log/secure<br><br>Feb 15 12:22:33 ipa-xyz sshd[13499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x user=tempuser<br>Feb 15 12:22:33 ipa-xyz sshd[13499]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x user=tempuser<br>Feb 15 12:22:33 ipa-xyz sshd[13499]: pam_sss(sshd:auth): received for user tempuser: 7 (Authentication failure)<br>Feb 15 12:22:33 ipa-xyz sshd[13499]: pam_ldap: ldap_simple_bind Can't contact LDAP server<br>Feb 15 12:22:33 ipa-xyz sshd[13499]: pam_ldap: reconnecting to LDAP server...<br>Feb 15 12:22:33 ipa-xyz sshd[13499]: pam_ldap: ldap_simple_bind Can't contact LDAP server<br>Feb 15 12:22:35 ipa-xyz sshd[13499]: Failed password for tempuser from x.x.x.x port 34318 ssh2<br>Feb 15 12:22:37 ipa-xyz sshd[13500]: Connection closed by x.x.x.x<br>Feb 15 12:31:32 ipa-xyz sshd[13859]: Accepted publickey for root from x.x.x.x port 56275 ssh2<br>Feb 15 12:31:32 ipa-xyz sshd[13859]: pam_unix(sshd:session): session opened for user root by (uid=0)<br>Feb 15 13:01:32 ipa-xyz sshd[13859]: Received disconnect from x.x.x.x: 11: disconnected by user<br><br></div>but both 389 and 636 ports are listening<br># ] netstat -tunlp |grep 636<br>tcp 0 0 :::636 :::* LISTEN 9564/ns-slapd<br><br>#] netstat -tunlp |grep 389<br>tcp 0 0 :::7389 :::* LISTEN 9495/ns-slapd<br>tcp 0 0 :::389 :::* LISTEN 9564/ns-slapd<br><br><br></div>And from /var/log/sssd/sssd_xyz.com.log<br><br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [pam_print_data] (0x0100): domain: <a href="http://xyz.com">xyz.com</a><br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [pam_print_data] (0x0100): user: tempuser<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [pam_print_data] (0x0100): service: sshd<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [pam_print_data] (0x0100): tty: ssh<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [pam_print_data] (0x0100): ruser:<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [pam_print_data] (0x0100): rhost: x.x.x.x<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [pam_print_data] (0x0100): authtok type: 1<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [pam_print_data] (0x0100): newauthtok type: 0<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [pam_print_data] (0x0100): priv: 1<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [pam_print_data] (0x0100): cli_pid: 13499<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [pam_print_data] (0x0100): logon name: not set<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [krb5_auth_prepare_ccache_name] (0x1000): No ccache file for user [tempuser] found.<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA'<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [get_server_status] (0x1000): Status of server '<a href="http://ipa.xyz.com">ipa.xyz.com</a>' is 'working'<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [get_port_status] (0x1000): Port status of port 0 for server '<a href="http://ipa.xyz.com">ipa.xyz.com</a>' is 'working'<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [get_server_status] (0x1000): Status of server '<a href="http://ipa.xyz.com">ipa.xyz.com</a>' is 'working'<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [be_resolve_server_process] (0x1000): Saving the first resolved server<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [be_resolve_server_process] (0x0200): Found address for server <a href="http://ipa.xyz.com">ipa.xyz.com</a>: [x.x.x.x] TTL 7200<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [write_pipe_handler] (0x0400): All data has been sent!<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [child_sig_handler] (0x1000): Waiting for child [13501].<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [child_sig_handler] (0x0100): child [13501] finished successfully.<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [read_pipe_handler] (0x0400): EOF received, client finished<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 7, <NULL>) [Success]<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [be_pam_handler_callback] (0x0100): Sending result [7][<a href="http://xyz.com">xyz.com</a>]<br>(Mon Feb 15 12:22:33 2016) [sssd[be[<a href="http://xyz.com">xyz.com</a>]]] [be_pam_handler_callback] (0x0100): Sent result [7][<a href="http://xyz.com">xyz.com</a>]<br><br><br></div><br></div>Thanks,<br></div>Rakesh<br><div><div><div><div><div><div><br></div></div></div></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Feb 15, 2016 at 3:45 PM, Jakub Hrozek <span dir="ltr"><<a href="mailto:jhrozek@redhat.com" target="_blank">jhrozek@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Mon, Feb 15, 2016 at 10:24:23AM +0530, Rakesh Rajasekharan wrote:<br> > hbac seems to be fine<br> ><br> ><br> > ipa hbactest --user=q-temp --host=x.x.x.x --service=sshd<br> > --------------------<br> > Access granted: True<br> > --------------------<br> > Matched rules: allow_all<br> ><br> ><br> > I see this in the sssd.log<br> ><br> > (Mon Feb 15 04:49:18 2016) [sssd[nss]] [sss_ncache_check_str] (0x2000):<br> > Checking negative cache for [NCE/USER/<a href="http://xyz.com/q-temp" rel="noreferrer" target="_blank">xyz.com/q-temp</a>]<br> > (Mon Feb 15 04:49:18 2016) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100):<br> > Requesting info for [<a href="mailto:q-temp@xyz.com">q-temp@xyz.com</a>]<br> > (Mon Feb 15 04:49:18 2016) [sssd[nss]] [check_cache] (0x0400): Cached entry<br> > is valid, returning..<br> > (Mon Feb 15 04:49:18 2016) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0400):<br> > Returning info for user [<a href="mailto:q-temp@xyz.com">q-temp@xyz.com</a>]<br> > (Mon Feb 15 04:49:18 2016) [sssd[nss]] [client_recv] (0x0200): Client<br> > disconnected!<br> > (Mon Feb 15 04:49:18 2016) [sssd[nss]] [client_destructor] (0x2000):<br> > Terminated client [0x23d2f80][20]<br> > (Mon Feb 15 04:49:27 2016) [sssd[nss]] [sbus_get_sender_id_send] (0x2000):<br> > Not a sysbus message, quit<br> <br> </span>What does /var/log/secure say?<br> <br> Also you pasted the NSS log, the domain log would be more useful here.<br> </blockquote></div><br></div>