<html><body><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000"><div>Hi, we have set up IPA in a AD trust and is about 90% done, but still have one problem using SSH login.</div><div><br data-mce-bogus="1"></div><div>Kerberos works:</div><div># kdestroy<br></div><div># kinit drextrha@NET.DR.DK<br>Password for drextrha@NET.DR.DK:<br># klist<br>Ticket cache: KEYRING:persistent:0:0<br>Default principal: drextrha@NET.DR.DK<br><br>Valid starting Expires Service principal<br>08/04/2016 12:46:17 08/04/2016 22:46:17 krbtgt/NET.DR.DK@NET.DR.DK<br> renew until 08/05/2016 12:46:09</div><div><br></div><div><br data-mce-bogus="1"></div><div>I can see the user:</div><div><br data-mce-bogus="1"></div><div># getent passwd drextrha@NET.DR.DK<br>drextrha@net.dr.dk:*:1349938498:1349938498:DREXTRHA:/home/net.dr.dk/drextrha:</div><div data-marker="__SIG_POST__"><br data-mce-bogus="1"></div><div data-marker="__SIG_POST__">However, can't log in using SSH:</div><div data-marker="__SIG_POST__"><br data-mce-bogus="1"></div><div data-marker="__SIG_POST__">login as: drextrha@NET.DR.DK<br>drextrha@NET.DR.DK@ipa02tst.linux.dr.dk's password:<br>Access denied<br></div><div data-marker="__SIG_POST__"><br data-mce-bogus="1"></div><div data-marker="__SIG_POST__"><br data-mce-bogus="1"></div><div data-marker="__SIG_POST__">When I look at the log files it looks correct, untill we receive a "<span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">be_pam_handler_callback] (0x0100): Backend returned: (0, 4, <NULL>) [Success (System error)]</span>" error, which I can't quite resolve or even verify if thats what's causing the problem.</div><div data-marker="__SIG_POST__"><br data-mce-bogus="1"></div><div data-marker="__SIG_POST__"><br data-mce-bogus="1"></div><div data-marker="__SIG_POST__">(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [krb5_auth_store_creds] (0x0010): unsupported PAM command [249].<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [krb5_auth_store_creds] (0x0010): password not available, offline auth may not work.<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 0, <NULL>) [Success (Success)]<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [be_pam_handler_callback] (0x0100): Sending result [0][net.dr.dk]<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [be_pam_handler_callback] (0x0100): Sent result [0][net.dr.dk]<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [be_pam_handler] (0x0100): Got request with the following data<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [pam_print_data] (0x0100): domain: net.dr.dk<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [pam_print_data] (0x0100): user: DREXTRHA@net.dr.dk<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [pam_print_data] (0x0100): service: sshd<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [pam_print_data] (0x0100): tty: ssh<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [pam_print_data] (0x0100): ruser:<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [pam_print_data] (0x0100): rhost: t01042.net.dr.dk<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [pam_print_data] (0x0100): authtok type: 1<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [pam_print_data] (0x0100): newauthtok type: 0<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [pam_print_data] (0x0100): priv: 1<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [pam_print_data] (0x0100): cli_pid: 17348<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [pam_print_data] (0x0100): logon name: not set<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA'<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [child_sig_handler] (0x0100): child [17356] finished successfully.<br>(Thu Aug 4 12:51:10 2016) [sssd[be[linux.dr.dk]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 4, <NULL>) [Success (System error)]<br></div><div data-marker="__SIG_POST__"><br data-mce-bogus="1"></div><div data-marker="__SIG_POST__"><br></div><div data-marker="__SIG_POST__">Everything running RHEL 7.2:</div><div data-marker="__SIG_POST__">IPA 4.2.0-15.el7_2.18</div><div data-marker="__SIG_POST__">SSSD 1.13.0-40.el7_2.12</div><div data-marker="__SIG_POST__"><br data-mce-bogus="1"></div><div data-marker="__SIG_POST__"><br data-mce-bogus="1"></div><div data-marker="__SIG_POST__">Anyone having any clues on how to proceed? Could of cause just raise it as an RedHat support case, but guite a lot of genious people sit in here :-)</div><div data-marker="__SIG_POST__"><br data-mce-bogus="1"></div><div data-marker="__SIG_POST__"><br data-mce-bogus="1"></div><div data-marker="__SIG_POST__">-- <br></div><div><p style="MARGIN: 5px 0px 0px; FONT-FAMILY: arial,verdana,sans-serif; FONT-SIZE: 12px" data-mce-style="margin: 5px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 12px;">Med venlig hilsen</p><p style="MARGIN: 10px 0px 0px; FONT-FAMILY: arial,verdana,sans-serif; FONT-SIZE: 14px" data-mce-style="margin: 10px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 14px;"><b>Troels Hansen</b></p><p style="MARGIN: 3px 0px 0px; FONT-FAMILY: arial,verdana,sans-serif; FONT-SIZE: 12px" data-mce-style="margin: 3px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 12px;">Systemkonsulent</p><p style="MARGIN: 4px 2px 0px 0px; FONT-FAMILY: arial,verdana,sans-serif; COLOR: #4c4c4c; FONT-SIZE: 14px; FONT-WEIGHT: bold" data-mce-style="margin: 4px 2px 0px 0px; font-family: arial,verdana,sans-serif; color: #4c4c4c; font-size: 14px; font-weight: bold;">Casalogic A/S</p><div><img src="http://www.casalogic.dk/signatur/casalogic_green_spacer_line.png" data-mce-src="http://www.casalogic.dk/signatur/casalogic_green_spacer_line.png" border="0"></div><p style="MARGIN: 5px 0px 0px; FONT-FAMILY: arial,verdana,sans-serif; FONT-SIZE: 12px" data-mce-style="margin: 5px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 12px;">T (+45) 70 20 10 63</p><p style="MARGIN: 5px 0px 0px; FONT-FAMILY: arial,verdana,sans-serif; FONT-SIZE: 12px" data-mce-style="margin: 5px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 12px;">M (+45) 22 43 71 57</p><div><a title="Download vCard" href="http://www.casalogic.dk/signatur/th.vcf" data-mce-href="http://www.casalogic.dk/signatur/th.vcf"><img src="http://www.casalogic.dk/signatur/vcard_download_small.png" data-mce-src="http://www.casalogic.dk/signatur/vcard_download_small.png" border="0"></a> <a title="Follow us on LinkedIn" href="http://www.linkedin.com/company/67524" data-mce-href="http://www.linkedin.com/company/67524"><img src="http://www.casalogic.dk/signatur/linkedin_logo_20x20.png" data-mce-src="http://www.casalogic.dk/signatur/linkedin_logo_20x20.png" border="0"></a> <a title="Follow us on Twitter" href="http://twitter.com/casalogic" data-mce-href="http://twitter.com/casalogic"><img src="http://www.casalogic.dk/signatur/twitter_logo_20x20.png" data-mce-src="http://www.casalogic.dk/signatur/twitter_logo_20x20.png" border="0"></a><br></div><div>Red Hat, SUSE, VMware, Citrix, Novell, Yellowfin BI, EnterpriseDB, Sophos og meget mere.<br></div></div></div></body></html>