client pam authentication failing intermittently

[prasad kumar]

Hi,

We are using IPA as host authentication for application service account sometime those
logins are failing and don't see any  errors in the ipa logs but server throwing PAM
authentication failed. I am new to freeipa and clue less how this process works and where
to troubleshoot. Could someone please guide me.

[Sumit Bose]

On Wed, Dec 16, 2020 at 10:40:05PM -0000, prasad kumar via FreeIPA-users wrote:
>  Hi,
>  
>  We are using IPA as host authentication for application service account sometime those
> logins are failing and don't see any  errors in the ipa logs but server throwing PAM
> authentication failed. I am new to freeipa and clue less how this process works and where
> to troubleshoot. Could someone please guide me. 
Hi,

looking at the PAM related messages in the journal or /var/log/secure is
the first step. If the authentication error is logged by the pam_sss
module you should check the SSSD logs files. The default log level is
most probably not sufficient to track the issue down. Please add
'debug_level=9' to the [pam] and [domain/...] sections in sssd.conf,
restart SSSD and try to reproduce the authentication error.

If you cannot find a hint in the logs feel free to send the part of the
logs covering the authentication attempt.

bye,
Sumit

>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...

[prasad kumar]

Thanks is sssd conf should be configured on server ?

[Sumit Bose]

On Thu, Dec 17, 2020 at 02:33:47PM -0000, prasad kumar via FreeIPA-users wrote:
>  Thanks is sssd conf should be configured on server ? 
Hi,

you should configure the logging on the host where the authentication
happens, i.e. the host where you see the PAM error messages.

bye,
Sumit

>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...