<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"> </head> <body text="#000000" bgcolor="#FFFFFF"> "Why don't you just use the /bin/sh as default shell in IPA ? In aix /bin/sh is the same as /bin/ksh and in linux it is a symlink to /bin/bash ." Wow, never thought of that, very elegant solution! <div class="moz-signature"> <meta name="ProgId" content="Word.Document"> <meta name="Generator" content="Microsoft Word 14"> <meta name="Originator" content="Microsoft Word 14"> <link rel="File-List" href="Assinatura_arquivos/filelist.xml"><link rel="themeData" href="Assinatura_arquivos/themedata.thmx"><link rel="colorSchemeMapping" href="Assinatura_arquivos/colorschememapping.xml"><style>  </style> <div class="WordSection1"> Atenciosamente/Best Regards<o:p></o:p> __________________________________________<o:p></o:p> Luiz Fernando Vianna da Silva<o:p></o:p> <o:p></o:p></div> </div> <div class="moz-cite-prefix">Em 12-05-2017 10:27, Iulian Roman escreveu: </div> <blockquote type="cite" cite="mid:CALjJZGk4ovmxnuR7gENw9nGe1wzP_x1cjnQ7fVB=QJGdBzoJ+Q@mail.gmail.com"> <div dir="ltr"> <div class="gmail_extra"> <div class="gmail_quote">On Fri, May 12, 2017 at 2:32 PM, <<a href="mailto:wouter.hummelink@kpn.com" target="_blank" moz-do-not-send="true">wouter.hummelink@kpn.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div lang="EN-US"> <div class="gmail-m_7926556652586221045WordSection1"> Hi All, We�re running a POC to integrate IPA and AIX using AIX KRB5LDAP compound module. All the moving parts seem to be working on their own, however logging in doesn�t work with SSH on AIX reporting Failed password for user <xxx> We�re using ID views to overwrite the user shell and home dirs. (Since AIX will refuse a login with a nonexisting shell (like bash)) </div> </div> </blockquote> <div> </div> <div>Why don't you just use the /bin/sh as default shell in IPA ? In aix /bin/sh is the same as /bin/ksh and in linux it is a symlink to /bin/bash . </div> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div lang="EN-US"> <div class="gmail-m_7926556652586221045WordSection1"> AIXs lsuser command is able to find all of the users it�s supposed to and su to IPA users works. Also when a user tries to log in I can see a successful Kerberos conversation to our IPA server. </div> </div> </blockquote> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div lang="EN-US"> <div class="gmail-m_7926556652586221045WordSection1"> Tips for troubleshooting would be much appreciated, increasing SSH log level did not produce any meaningful logging. =============== Configuration Excerpt ================================================================ /etc/security/ldap/ldap.cfg: ldapservers:ipaserver.example.org binddn:uid=srvc-aixservice,cn=users,cn=accounts,dc=example,dc=org bindpwd:{DESv2}<redacted> authtype:ldap_auth useSSL:TLS ldapsslkeyf:/etc/security/ldap/example.kdb ldapsslkeypwd:{DESv2}4688216124E33174C03FBBB420 88FA8 932F219867AA7C2C552A12BEEC0CC67 useKRB5:yes krbprincipal:host/aixlpar.<a href="http://example.org" moz-do-not-send="true">example.org</a> krbkeypath:/etc/krb5/krb5.keytab userattrmappath:/etc/security/ldap/2307user.map groupattrmappath:/etc/security/ldap/2307group.map userbasedn:cn=users,cn=aixtest,cn=views,cn=compat,dc=example,dc=org groupbasedn:cn=groups,cn=aixtest,cn=views,cn=compat,dc=example,dc=org netgroupbasedn:cn=ng,cn=compat,dc=example,dc=org automountbasedn:cn=default,cn=automount,dc=example,dc=org etherbasedn:cn=computers,cn=accounts,dc=example,dc=org userclasses:posixaccount,account,shadowaccount groupclasses:posixgroup ldapport:389 searchmode:ALL defaultentrylocation:LDAP /etc/security/user default: SYSTEM = KRB5LDAP or compat </div> </div> </blockquote> <div> </div> <div>I am using the following settings in in /etc/security/user: </div> <div>SYSTEM = KRB5LDAP </div> <div>registry = KRB5LDAP </div> <div>it works for AIX5,6 and 7 in my setup. </div> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div lang="EN-US"> <div class="gmail-m_7926556652586221045WordSection1"> /etc/methods.cfg <div style="border-width:medium medium medium 1pt;border-style:none none none solid;border-color:currentcolor currentcolor currentcolor windowtext;padding:0cm 0cm 0cm 4pt;margin-left:1cm;margin-right:0cm"> LDAP: program = /usr/lib/security/LDAP program_64 =/usr/lib/security/LDAP64 NIS: program = /usr/lib/security/NIS program_64 = /usr/lib/security/NIS_64 DCE: program = /usr/lib/security/DCE KRB5: program = /usr/lib/security/KRB5 program_64 = /usr/lib/security/KRB5_64 options = authonly,is_kadmind_compat=no,tgt_verify=yes,kadmind=no,keep_creds=yes,allow_expired_pwd=no KRB5LDAP: options = auth=KRB5,db=LDAP </div> Met vriendelijke groet, <div style="border-width:medium medium 1pt;border-style:none none solid;border-color:currentcolor currentcolor windowtext;padding:0cm 0cm 1pt"> Wouter Hummelink </div> Technical Consultant - Enterprise Webhosting / Tooling & Automation T: <a value="+31612882447" moz-do-not-send="true"> +31-6-12882447</a> E: <a moz-do-not-send="true"> wouter.hummelink@kpn.com</a> </div> </div> -- Manage your subscription for the Freeipa-users mailing list: <a href="https://www.redhat.com/" moz-do-not-send="true">https://www.redhat.com/</a>mailman/listinfo/freeipa-users Go to <a href="http://freeipa.org" moz-do-not-send="true">http://freeipa.org</a> for more info on the project </blockquote> </div> </div> </div> </blockquote> </body> </html>