<div dir="ltr"><div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name 'staaj' matched without domain, user is staaj</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)]</div>
<div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_ACCT_MGMT</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): domain: not set</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): user: staaj</div>
<div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): service: sshd</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set</div>
<div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): rhost: 50.59.202.7</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 0</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): authtok size: 0</div>
<div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): newauthtok size: 0</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): priv: 1</div>
<div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 23185</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/USER/<a href="http://company-dev.com/staaj">company-dev.com/staaj</a>]</div>
<div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sss_dp_issue_request] (0x0400): Issuing request for [<a href="mailto:0x41b300%3A3%3Astaaj@vocal-dev.com">0x41b300:3:staaj@vocal-dev.com</a>]</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sss_dp_get_account_msg] (0x0400): Creating request for [<a href="http://company-dev.com">company-dev.com</a>][3][1][name=staaj]</div>
<div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sbus_add_timeout] (0x2000): 0xb39fd0</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sss_dp_internal_get_send] (0x0400): Entering request [<a href="mailto:0x41b300%3A3%3Astaaj@company-dev.com">0x41b300:3:staaj@company-dev.com</a>]</div>
<div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sbus_remove_timeout] (0x2000): 0xb39fd0</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn: B35A10</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sbus_dispatch] (0x4000): Dispatching.</div>
<div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 0 errno: 0 error message: Success</div></div><div><br></div><div><br></div><div><br></div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending request with the following data:</div>
<div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_ACCT_MGMT</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): domain: <a href="http://company-dev.com">company-dev.com</a></div>
<div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): user:staaj</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): service: sshd</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh</div>
<div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): rhost: 50.59.202.7</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 0</div>
<div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): authtok size: 0</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): newauthtok size: 0</div>
<div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): priv: 1</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 23185</div><div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sbus_add_timeout] (0x2000): 0xb41990</div>
<div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0</div><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sss_dp_req_destructor] (0x0400): Deleting request: [<a href="mailto:0x41b300%3A3%3Astaaj@company-dev.com">0x41b300:3:staaj@company-dev.com</a>]</div>
</div><div><br></div><div style>only thing i see about selinux is here </div><div style><br></div><div style><div>(Wed Apr 10 14:22:45 2013) [sssd[pam]] [write_selinux_login_file] (0x0040): creating the temp file for SELinux data failed. /etc/selinux/targeted/logins/staajtlQ108(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_reply] (0x0100): blen: 30</div>
<div><br></div><div><div># rpm -qa |grep sssd</div><div>sssd-client-1.9.2-82.4.el6_4.x86_64</div><div>sssd-1.9.2-82.4.el6_4.x86_64</div><div> </div><div><br></div></div><div><br></div></div><div class="gmail_extra"><br><br>
<div class="gmail_quote">On Wed, Apr 10, 2013 at 2:15 PM, Jakub Hrozek <span dir="ltr"><<a href="mailto:jhrozek@redhat.com" target="_blank">jhrozek@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb"><div class="h5">On Wed, Apr 10, 2013 at 02:11:14PM -0400, Rob Crittenden wrote:<br>
> Shawn wrote:<br>
> >[root@freeipa ~]# ipa hbactest --user=myuser --host=my.fqdn. --service=sshd<br>
> >--------------------<br>
> >Access granted: True<br>
> >--------------------<br>
> > Matched rules: allow_all<br>
> >[root@freeipa ~]#<br>
> ><br>
> ><br>
> >└─> ssh <a href="mailto:myuserj@ec2-54-xxx.xxx.compute-1.amazonaws.com">myuserj@ec2-54-xxx.xxx.compute-1.amazonaws.com</a><br>
> ><mailto:<a href="mailto:myuserj@ec2-54-xxx.xxx.compute-1.amazonaws.com">myuserj@ec2-54-xxx.xxx.compute-1.amazonaws.com</a>> -i<br>
> >/home/user/.ssh/key<br>
> >Connection closed by 54x.x.x.x<br>
> ><br>
> >(client server logs)<br>
> >Apr 10 13:59:04 ip-10-152-174-17 sshd[22868]: pam_sss(sshd:account):<br>
> >Access denied for user myuser: 4 (System error)<br>
> >Apr 10 13:59:04 ip-10-152-174-17 sshd[22872]: fatal: Access denied for<br>
> >user client by PAM account configuration<br>
> ><br>
> ><br>
> >(client ipa versions)<br>
> >ipa-admintools-3.0.0-26.el6_4.2.x86_64<br>
> >ipa-client-3.0.0-26.el6_4.2.x86_64<br>
> >ipa-python-3.0.0-26.el6_4.2.x86_64<br>
> ><br>
> ><br>
> >(master ipa versions)<br>
> >[root@freeipa ~]# rpm -qa |grep ipa-<br>
> ><br>
> >ipa-pki-common-theme-9.0.3-7.el6.noarch<br>
> >ipa-pki-ca-theme-9.0.3-7.el6.noarch<br>
> >ipa-client-3.0.0-26.el6_4.2.x86_64<br>
> >ipa-python-3.0.0-26.el6_4.2.x86_64<br>
> >ipa-admintools-3.0.0-26.el6_4.2.x86_64<br>
> >ipa-server-selinux-3.0.0-26.el6_4.2.x86_64<br>
> >ipa-server-3.0.0-26.el6_4.2.x86_64<br>
> >[root@freeipa ~]#<br>
><br>
> An error is occurring somewhere which is why access is denied. This<br>
> isn't HBAC, that looks like:<br>
><br>
> pam_sss(sshd:account): Access denied for user admin: 6 (Permission denied)<br>
><br>
> You need to crank up debugging in sssd and see what its logs say.<br>
><br>
> rob<br>
<br>
</div></div>What SSSD version is there on the client?<br>
<br>
It's possible that it might be a similar issue to one Jan-Frode had with<br>
SELinux.<br>
<br>
Rob is right, please raise the debug_level in the [pam] and [domain]<br>
sections and attach or paste the relevant portions of (sanitized) logs.<br>
<div class="HOEnZb"><div class="h5"><br>
_______________________________________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a></div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><b><i>- Shawn Taaj</i></b><br>
</div></div>