<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(51,51,51)">Hi</div><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(51,51,51)"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(51,51,51)">With further debugging, I discovered, that I messed up the /etc/sssd/sssd.conf file. There, I added:</div><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(51,51,51)"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(51,51,51)">…</div><div class="gmail_default" style=""><div class="gmail_default" style=""><font color="#333333" face="tahoma, sans-serif">[domain/</font><span style="font-size:12.8000001907349px">customer.</span><span style="font-size:12.8000001907349px">company.internal</span><font color="#333333" face="tahoma, sans-serif">]</font></div><div class="gmail_default" style=""><font color="#333333" face="tahoma, sans-serif"><br></font></div><div class="gmail_default" style=""><font color="#333333" face="tahoma, sans-serif">krb5_realm = </font><span style="font-size:12.8000001907349px">customer.</span><span style="font-size:12.8000001907349px">company.internal</span></div><div style="color:rgb(51,51,51);font-family:tahoma,sans-serif">…</div><div style="color:rgb(51,51,51);font-family:tahoma,sans-serif"><br></div><div style="color:rgb(51,51,51);font-family:tahoma,sans-serif"><br></div><div style="color:rgb(51,51,51);font-family:tahoma,sans-serif"><br></div><div style="color:rgb(51,51,51);font-family:tahoma,sans-serif">Exactly like that. With "<font color="#333333" face="tahoma, sans-serif">krb5_realm = </font><span style="font-family:arial,sans-serif;color:rgb(34,34,34);font-size:12.8000001907349px">customer.</span><span style="font-family:arial,sans-serif;color:rgb(34,34,34);font-size:12.8000001907349px">company.internal"; ie. with the realm in lowercase letters.</span></div><div style="color:rgb(51,51,51);font-family:tahoma,sans-serif"><span style="font-family:arial,sans-serif;color:rgb(34,34,34);font-size:12.8000001907349px"><br></span></div><div style="color:rgb(51,51,51);font-family:tahoma,sans-serif"><span style="font-family:arial,sans-serif;color:rgb(34,34,34);font-size:12.8000001907349px">After having changed that to uppercase letters (ie. </span>"<font color="#333333" face="tahoma, sans-serif">krb5_realm = CUSTOMER.COMPANY.INTERNAL</font><span style="font-family:arial,sans-serif;color:rgb(34,34,34);font-size:12.8000001907349px">"), it works fine.</span></div><div style="color:rgb(51,51,51);font-family:tahoma,sans-serif"><span style="font-family:arial,sans-serif;color:rgb(34,34,34);font-size:12.8000001907349px"><br></span></div><div style="color:rgb(51,51,51);font-family:tahoma,sans-serif"><span style="font-family:arial,sans-serif;color:rgb(34,34,34);font-size:12.8000001907349px"><br></span></div><div style="color:rgb(51,51,51);font-family:tahoma,sans-serif"><span style="font-family:arial,sans-serif;color:rgb(34,34,34);font-size:12.8000001907349px"><br></span></div><div style="color:rgb(51,51,51);font-family:tahoma,sans-serif"><span style="font-family:arial,sans-serif;color:rgb(34,34,34);font-size:12.8000001907349px">Thanks for your time and help ;)</span></div><div style="color:rgb(51,51,51);font-family:tahoma,sans-serif"><span style="font-family:arial,sans-serif;color:rgb(34,34,34);font-size:12.8000001907349px"><br></span></div><div style="color:rgb(51,51,51);font-family:tahoma,sans-serif"><span style="font-family:arial,sans-serif;color:rgb(34,34,34);font-size:12.8000001907349px">Cheers,</span></div><div style="color:rgb(51,51,51);font-family:tahoma,sans-serif"><span style="font-family:arial,sans-serif;color:rgb(34,34,34);font-size:12.8000001907349px">Alexander</span></div><div style="color:rgb(51,51,51);font-family:tahoma,sans-serif"><br></div><div style="color:rgb(51,51,51);font-family:tahoma,sans-serif"><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-10-05 14:07 GMT+02:00 Sumit Bose <span dir="ltr"><<a href="mailto:sbose@redhat.com" target="_blank">sbose@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Mon, Oct 05, 2015 at 09:00:13AM +0200, Alexander Skwar wrote:<br> > Hi<br> ><br> > Hm, there's nothing at all in the /var/log/sssd/krb5_child.log when I try<br> > to login with SSH and enter a password.<br> <br> </span>Can you try to increase the debug_level to 0xFFF0?<br> <span class=""><br> ><br> > kinit doesn't work.<br> ><br> > $ kinit -k<br> > kinit: Permission denied while getting initial credentials<br> ><br> > For this test, I was root and then did a "su - user" and then "kinit -k".<br> > Also after the "kinit -k", nothing is in the krb5_child.log.<br> <br> </span>The 'kinit -k' has to be done as root. It will only check if the client<br> can connect to the KDC at all and tries to get a TGT for the host.<br> <br> It's expected that during this operation nothing is added to the SSSD<br> logs because the kinit utility work independent of SSSD.<br> <br> bye,<br> Sumit<br> <div><div class="h5"><br> ><br> > Regards,<br> > Alexander<br> ><br> ><br> > 2015-10-02 17:59 GMT+02:00 Jakub Hrozek <<a href="mailto:jhrozek@redhat.com">jhrozek@redhat.com</a>>:<br> ><br> > > On Fri, Oct 02, 2015 at 04:28:57PM +0200, Alexander Skwar wrote:<br> > > > Hello<br> > > ><br> > > > How do I get password authentication to work with freeipa-client<br> > > > 3.3.4-0ubuntu3.1 on Ubuntu 14.04 for ssh and sudo?<br> > > ><br> > > > Long version follows :)<br> > > ><br> > > > We've got an IPA server with the Red Hat Identity Management server<br> > > > on RHEL 7.1 servers; FreeIPA v4.1.0 is being used there. I configured<br> > > > users and groups there and would now like to login with SSH. When I<br> > > > store a SSH key for the user account, I can login just fine, using<br> > > > this SSH key. But I'd like/need to use passwords as well. And sudo<br> > > > also doesn't work, when it's asking for passwords - I supposed,<br> > > > it's the same root cause.<br> > > ><br> > > > Let's stick with SSH.<br> > > ><br> > > > Initially, I installed the FreeIPA client with this command line:<br> > > ><br> > > > ipa-client-install --force-join --mkhomedir --ssh-trust-dns \<br> > > > --enable-dns-updates --unattended \<br> > > > --principal=admin --password=correctone \<br> > > > --domain=customer.company.internal \<br> > > > --server=auth01.customer.company.internal<br> > > ><br> > > > I then try to do a SSH login with:<br> > > ><br> > > > ssh -l ewt@customer.company.internal 192.168.229.143<br> > > > or:<br> > > > ssh -l ewt 192.168.229.143<br> > > ><br> > > > Password authentication doesn't work.<br> > > ><br> > > > In the /var/log/syslog on the system where I try to login, I find this:<br> > > ><br> > > > 2015-10-02T15:33:38.771291+02:00 mgmt02 [sssd[krb5_child[14154]]]:<br> > > > Key table entry not found<br> > > ><br> > > > After having turned up the debug level of the sssd with "sssd -i -f -d<br> > > > 0x0770 --debug-timestamps=1", I find the following in the system log<br> > > > files:<br> > > ><br> > > > 2015-10-02T15:40:48.756399+02:00 mgmt02 sshd[14194]:<br> > > > pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0<br> > > > tty=ssh ruser= rhost=212.71.117.1 user=ewt<br> > > > 2015-10-02T15:40:48.775896+02:00 mgmt02 sshd[14194]:<br> > > > pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0<br> > > > tty=ssh ruser= rhost=212.71.117.1 user=ewt<br> > > > 2015-10-02T15:40:48.775927+02:00 mgmt02 sshd[14194]:<br> > > > pam_sss(sshd:auth): received for user ewt: 4 (System error)<br> > > > 2015-10-02T15:40:50.988591+02:00 mgmt02 sshd[14194]: Failed<br> > > > password for ewt from 212.71.117.1 port 58136 ssh2<br> > > ><br> > > > TBH, I don't quite understand it. Anyway, in<br> > > > /var/log/sssd/sssd_customer.company.internal.log I noticed:<br> > > ><br> > > > (Fri Oct 2 15:46:26 2015) [sssd[be[customer.company.internal]]]<br> > > > [read_pipe_handler] (0x0400): EOF received, client finished<br> > > > (Fri Oct 2 15:46:26 2015) [sssd[be[customer.company.internal]]]<br> > > > [parse_krb5_child_response] (0x0020): message too short.<br> > > > (Fri Oct 2 15:46:26 2015) [sssd[be[customer.company.internal]]]<br> > > > [krb5_auth_done] (0x0040): Could not parse child response [22]:<br> > > > Invalid argument<br> > > > (Fri Oct 2 15:46:26 2015) [sssd[be[customer.company.internal]]]<br> > > > [ipa_auth_handler_done] (0x0040): krb5_auth_recv request failed.<br> > > ><br> > > > Well… What am I doing wrong or what might I have forgotten?<br> > ><br> > > We need to also see the krb5_child.log but please check if the keytab is<br> > > correct (ie kinit -k works).<br> > ><br> > > --<br> > > Manage your subscription for the Freeipa-users mailing list:<br> > > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br> > > Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br> > ><br> ><br> ><br> ><br> > --<br> ><br> ><br> > Alexander<br> > --<br> </div></div>> => *Google+* => <a href="http://plus.skwar.me" rel="noreferrer" target="_blank">http://plus.skwar.me</a> <==<br> > => *Chat* (Jabber/Google Talk) => <a href="mailto:a.skwar@gmail.com">a.skwar@gmail.com</a> <==<br> <div class="HOEnZb"><div class="h5"><br> > --<br> > Manage your subscription for the Freeipa-users mailing list:<br> > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br> > Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br> <br> </div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><pre cols="72"><font face="verdana, sans-serif"><br> </font><font face="courier new, monospace">Alexander -- => <b><i>Google+</i></b> => <a href="http://plus.skwar.me/" target="_blank">http://plus.skwar.me</a> <== => <b><i>Chat</i></b> (Jabber/Google Talk) => <a href="mailto:a.skwar@gmail.com" target="_blank">a.skwar@gmail.com</a> <== </font></pre><div><font face="courier new, monospace"><br></font></div></div></div> </div>