<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"> </head> <body text="#000000" bgcolor="#FFFFFF"> Hello Wouter. It may seem silly, but try installing bash on one AIX server and test authenticating against that one. Its a single rpm with no dependencies. For me it did the trick and I ended up doing that on all my AIX servers. Let me know how it goes or if you have any issues. <div class="moz-signature"> <meta name="ProgId" content="Word.Document"> <meta name="Generator" content="Microsoft Word 14"> <meta name="Originator" content="Microsoft Word 14"> <link rel="File-List" href="Assinatura_arquivos/filelist.xml"><link rel="themeData" href="Assinatura_arquivos/themedata.thmx"><link rel="colorSchemeMapping" href="Assinatura_arquivos/colorschememapping.xml"><style>  </style> <div class="WordSection1"> Best Regards<o:p></o:p> __________________________________________<o:p></o:p> Luiz Fernando Vianna da Silva<o:p></o:p> <o:p></o:p> </div> </div> <div class="moz-cite-prefix">Em 12-05-2017 09:47, <a class="moz-txt-link-abbreviated" href="mailto:wouter.hummelink@kpn.com"> wouter.hummelink@kpn.com</a> escreveu: </div> <blockquote type="cite" cite="mid:2CA71D6C07ADB544847562573DC6BF062B3D3796@CPEMS-KPN309.KPNCNL.LOCAL"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> <div class="WordSection1"> Hi All, <o:p></o:p> <o:p> </o:p> We�re running a POC to integrate IPA and AIX using AIX KRB5LDAP compound module. <o:p></o:p> All the moving parts seem to be working on their own, however logging in doesn�t work with SSH on AIX reporting Failed password for user <xxx><o:p></o:p> <o:p> </o:p> We�re using ID views to overwrite the user shell and home dirs. (Since AIX will refuse a login with a nonexisting shell (like bash))<o:p></o:p> AIXs lsuser command is able to find all of the users it�s supposed to and su to IPA users works.<o:p></o:p> Also when a user tries to log in I can see a successful Kerberos conversation to our IPA server.<o:p></o:p> <o:p> </o:p> Tips for troubleshooting would be much appreciated, increasing SSH log level did not produce any meaningful logging.<o:p></o:p> <o:p> </o:p> =============== Configuration Excerpt ================================================================<o:p></o:p> /etc/security/ldap/ldap.cfg:<o:p></o:p> ldapservers:ipaserver.example.org<o:p></o:p> binddn:uid=srvc-aixservice,cn=users,cn=accounts,dc=example,dc=org<o:p></o:p> bindpwd:{DESv2}<redacted><o:p></o:p> authtype:ldap_auth<o:p></o:p> useSSL:TLS<o:p></o:p> ldapsslkeyf:/etc/security/ldap/example.kdb<o:p></o:p> ldapsslkeypwd:{DESv2}4688216124E33174C03FBBB420 88FA8 932F219867AA7C2C552A12BEEC0CC67<o:p></o:p> useKRB5:yes<o:p></o:p> krbprincipal:host/aixlpar.example.org<o:p></o:p> krbkeypath:/etc/krb5/krb5.keytab<o:p></o:p> userattrmappath:/etc/security/ldap/2307user.map<o:p></o:p> groupattrmappath:/etc/security/ldap/2307group.map<o:p></o:p> userbasedn:cn=users,cn=aixtest,cn=views,cn=compat,dc=example,dc=org<o:p></o:p> groupbasedn:cn=groups,cn=aixtest,cn=views,cn=compat,dc=example,dc=org<o:p></o:p> netgroupbasedn:cn=ng,cn=compat,dc=example,dc=org<o:p></o:p> automountbasedn:cn=default,cn=automount,dc=example,dc=org<o:p></o:p> etherbasedn:cn=computers,cn=accounts,dc=example,dc=org<o:p></o:p> userclasses:posixaccount,account,shadowaccount<o:p></o:p> groupclasses:posixgroup<o:p></o:p> ldapport:389<o:p></o:p> searchmode:ALL<o:p></o:p> defaultentrylocation:LDAP<o:p></o:p> <o:p> </o:p> /etc/security/user default:<o:p></o:p> SYSTEM = KRB5LDAP or compat<o:p></o:p> /etc/methods.cfg<o:p></o:p> <div style="mso-element:para-border-div;border:none;border-left:solid windowtext 1.0pt;padding:0cm 0cm 0cm 4.0pt;margin-left:1.0cm;margin-right:0cm"> LDAP:<o:p></o:p> program = /usr/lib/security/LDAP<o:p></o:p> program_64 =/usr/lib/security/LDAP64 <o:p></o:p> NIS:<o:p></o:p> program = /usr/lib/security/NIS<o:p></o:p> program_64 = /usr/lib/security/NIS_64<o:p></o:p> DCE:<o:p></o:p> program = /usr/lib/security/DCE<o:p></o:p> KRB5:<o:p></o:p> program = /usr/lib/security/KRB5<o:p></o:p> program_64 = /usr/lib/security/KRB5_64<o:p></o:p> options = authonly,is_kadmind_compat=no,tgt_verify=yes,kadmind=no,keep_creds=yes,allow_expired_pwd=no<o:p></o:p> <o:p> </o:p> KRB5LDAP:<o:p></o:p> options = auth=KRB5,db=LDAP<o:p></o:p> </div> <o:p> </o:p> <o:p> </o:p> Met vriendelijke groet,<o:p></o:p> <div style="mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;padding:0cm 0cm 1.0pt 0cm"> Wouter Hummelink<o:p></o:p> </div> Technical Consultant - Enterprise Webhosting / Tooling & Automation<o:p></o:p> T: +31-6-12882447<o:p></o:p> E: <a href="mailto:wouter.hummelink@kpn.com" moz-do-not-send="true"> wouter.hummelink@kpn.com</a><o:p></o:p> <o:p> </o:p> </div> </blockquote> </body> </html>