<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> On 04/05/2013 08:00 AM, Jan-Frode Myklebust wrote: <blockquote cite="mid:20130405120058.GA24411@dibs.tanso.net" type="cite"> <pre wrap="">On Fri, Mar 22, 2013 at 06:43:07PM +0100, Jan-Frode Myklebust wrote: </pre> <blockquote type="cite"> <pre wrap=""> </pre> <blockquote type="cite"> <pre wrap=""> Does the problem go away if you set: selinux_provider = none </pre> </blockquote> </blockquote> <pre wrap=""> Sorry, no. Also the "No SELinux user maps found!" didn't go away. At "Apr 5 13:46:22" I was denied access again by pam_access, and then seconds later I could log in: Apr 5 13:46:22 ipa2 sshd[15417]: pam_access(sshd:account): access denied for user `janfrode' from `login2.example.com' Apr 5 13:46:29 ipa2 sshd[15423]: pam_unix(sshd:session): session opened for user janfrode by (uid=0) Apr 5 13:46:33 ipa2 su: pam_unix(su-l:session): session opened for user root by janfrode(uid=15019) debug=6 logs attached. Any other suggestions? </pre> </blockquote> SELinux seems to be OK but the log definitely showing that not all users are successfully stored in a group. <blockquote cite="mid:20130405120058.GA24411@dibs.tanso.net" type="cite"> <pre wrap=""> -jf </pre> <fieldset class="mimeAttachmentHeader"></fieldset> <pre wrap="">_______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>