<div dir="ltr"><div><div><div>The permission for /etc/krb5.conf was already set to 644. So, that aspect looks fine.. </div>I think it might be something to do with the pam settings. </div><div>here is my sssd.conf [root@ipa-client :/etc/sssd] cat sssd.con [domain/<a href="http://xyz.com">xyz.com</a>] krb5_auth_timeout = 30 cache_credentials = True krb5_store_password_if_offline = True ipa_domain = <a href="http://xyz.com">xyz.com</a> id_provider = ipa auth_provider = ipa access_provider = ipa ldap_tls_cacert = /etc/ipa/ca.crt ipa_hostname = x.x.x.x chpass_provider = ipa ipa_server = _srv_, <a href="http://ipa-master.xyz.com">ipa-master.xyz.com</a> dns_discovery_domain = <a href="http://xyz.com">xyz.com</a> [domain/default] ldap_id_use_start_tls = True cache_credentials = True ldap_search_base = dc=ldap,dc=qa,dc=xyz,dc=com krb5_realm = <a href="http://xyz.com">xyz.com</a> krb5_server = <a href="http://ipa-master.xyz.com:88">ipa-master.xyz.com:88</a> id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldaps://<a href="http://ldap-int.xyz.com:636">ldap-int.xyz.com:636</a> ldap_tls_cacertdir = /etc/openldap/cacerts [sssd] services = nss, sudo, pam, ssh config_file_version = 2 domains = default, <a href="http://xyz.com">xyz.com</a> [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp] </div><div> </div>Thanks, </div>Rakesh </div><div class="gmail_extra"> <div class="gmail_quote">On Thu, Feb 18, 2016 at 6:52 PM, Martin Kosek <<a href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 02/18/2016 02:11 PM, Rakesh Rajasekharan wrote: > I set up freeipa on our environment and its works perfectly for most of the > hosts.. but on few I am getting a permission denied. > > [root@ipa-client-1c :~] ssh tempuser@localhost > tempuser@localhost's password: > Permission denied, please try again. > tempuser@localhost's password: > > > > > I checked the hbac, but that seems to be fine > > root@ipa-master-test-1b ] ipa hbactest --user=tempuser --host=x.x.x.x > --service=sshd > -------------------- > Access granted: True > -------------------- > Matched rules: allow_all > > > Another thing I noticed is the nsswitch.conf had the below entries after > the freeipa installation > passwd: files sss ldap > shadow: files sss ldap > group: files sss ldap > > hosts: files dns > > > bootparams: nisplus [NOTFOUND=return] files > > ethers: files > netmasks: files > networks: files > protocols: files > rpc: files > services: files sss > > netgroup: files sss ldap > > publickey: nisplus > > automount: files ldap > aliases: files nisplus > > sudoers: files sss > > > The ldap shouldn't be there above I guess.. > > and from the logs, i have the below errors > > ==> /var/log/secure <== > Feb 18 03:29:33 ip-x-x-x-x sshd[24851]: pam_unix(sshd:auth): authentication > failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x user=tempuser > Feb 18 03:29:33 ip-x-x-x-x sshd[24851]: pam_sss(sshd:auth): authentication > failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x user=tempuser > Feb 18 03:29:33 ip-x-x-x-x sshd[24851]: pam_sss(sshd:auth): received for > user tempuser: 4 (System error) > Feb 18 03:29:35 ip-x-x-x-x sshd[24851]: Failed password for tempuser from > x.x.x.x port 36687 ssh2 > Feb 18 03:29:39 ip-x-x-x-x sshd[24853]: Connection closed by x.x.x.x > Feb 18 03:34:17 ip-x-x-x-x sshd[25108]: pam_unix(sshd:auth): authentication > failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=tempuser > Feb 18 03:34:17 ip-x-x-x-x sshd[25108]: pam_sss(sshd:auth): authentication > failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=tempuser > Feb 18 03:34:17 ip-x-x-x-x sshd[25108]: pam_sss(sshd:auth): received for > user tempuser: 4 (System error) > Feb 18 03:34:19 ip-x-x-x-x sshd[25108]: Failed password for tempuser from > 127.0.0.1 port 59870 ssh2 > > > ==> /var/log/messages <== > Feb 18 03:37:45 ip-x-x-x-x sssd[be[<a href="http://xyz.com" rel="noreferrer" target="_blank">xyz.com</a>]]: Shutting down > Feb 18 03:37:45 ip-x-x-x-x sssd: Starting up > Feb 18 03:37:46 ip-x-x-x-x sssd[be[<a href="http://xyz.com" rel="noreferrer" target="_blank">xyz.com</a>]]: Starting up > Feb 18 03:37:46 ip-x-x-x-x sssd[nss]: Starting up > Feb 18 03:37:46 ip-x-x-x-x sssd[sudo]: Starting up > Feb 18 03:37:46 ip-x-x-x-x sssd[pam]: Starting up > Feb 18 03:37:46 ip-x-x-x-x sssd[pac]: Starting up > Feb 18 03:37:46 ip-x-x-x-x sssd[ssh]: Starting up > Feb 18 03:37:46 ip-x-x-x-x sssd[be[<a href="http://xyz.com" rel="noreferrer" target="_blank">xyz.com</a>]]: dereference processing failed > : Input/output error > Feb 18 03:37:46 ip-x-x-x-x sssd[be[<a href="http://xyz.com" rel="noreferrer" target="_blank">xyz.com</a>]]: dereference processing failed > : Input/output error > Feb 18 03:38:41 ip-x-x-x-x [sssd[krb5_child[25324]]]: Permission denied > Feb 18 03:38:41 ip-x-x-x-x [sssd[krb5_child[25324]]]: Permission denied </div></div>Could it be caused by /etc/krb5.conf permissions as here: <a href="https://lists.fedorahosted.org/pipermail/sssd-users/2014-August/002103.html" rel="noreferrer" target="_blank">https://lists.fedorahosted.org/pipermail/sssd-users/2014-August/002103.html</a> ? Some advise is also here: <a href="http://serverfault.com/questions/697113/linux-ad-integration-unable-to-login-when-using-windows-server-2012-dc" rel="noreferrer" target="_blank">http://serverfault.com/questions/697113/linux-ad-integration-unable-to-login-when-using-windows-server-2012-dc</a> Martin </blockquote></div> </div>