PLatform is RHEL 6 Update 6.
Relevent RPMS are :
sssd-ad-1.11.6-30.el6.x86_64 krb5-workstation-1.10.3-33.el6.x86_64
Pam was setup using " authconfig --enablesssd --enablesssdauth --enablemkhomedir --update"
I have test users successfully authenticating against a test domain server with both the test linux RHEL6U6 box and the Windows 2008R2 AD server on an isolated subnet.
After I login to the RHEL6U6 box with an AD user via either ssh, or via the console I cannot run 'su - <username>' to any other user, either AD based or local password file based. All I get is a 'incorrect password' error message.
My sssd.conf:
[sssd] config_file_version = 2 domains = CORPTEST.LOCAL services = nss, pam debug_level = 10 timeout = 300
[domain/CORPTEST.LOCAL]
id_provider = ad auth_provider = ad access_provider = ad
debug_level = 10
ldap_id_mapping = False
default shell = /bin/bash fallback_homedir = /home/%u
use_fully_qualified_names = False
nsswitch.conf has these lines for passwd, shadow and group:
passwd: files sss shadow: files sss group: files sss
/etc/pam.d/system-auth-ac (not hand edited at all)
#%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_fprintd.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_sss.so use_first_pass auth required pam_deny.so
account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so
session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so
The sssd-ad package in rhel6 update 6 is fairly new and as such I've been able to find limited web resources about its config directives.
Any help you can provide will be appreciated.
Cheers, Chris
On (15/01/15 12:57), cprice@its.to wrote:
PLatform is RHEL 6 Update 6.
Relevent RPMS are :
sssd-ad-1.11.6-30.el6.x86_64 krb5-workstation-1.10.3-33.el6.x86_64
Pam was setup using " authconfig --enablesssd --enablesssdauth --enablemkhomedir --update"
I have test users successfully authenticating against a test domain server with both the test linux RHEL6U6 box and the Windows 2008R2 AD server on an isolated subnet.
After I login to the RHEL6U6 box with an AD user via either ssh, or via the console I cannot run 'su - <username>' to any other user, either AD based or local password file based. All I get is a 'incorrect password' error message.
That's interesting. Are you able to login with ssh to the machine with two+ users in parallel sessions.
Is there anything interesting in /var/log/secure?
I can see you have enabled debugging in domain section. You can filter the most critical message with next grep command.
grep -E': grep -E "(0x00[1-9]0)" /var/log/sssd/sssd_CORPTEST.LOCAL.log
My sssd.conf:
[sssd] config_file_version = 2 domains = CORPTEST.LOCAL services = nss, pam debug_level = 10 timeout = 300
[domain/CORPTEST.LOCAL]
id_provider = ad auth_provider = ad access_provider = ad
debug_level = 10
ldap_id_mapping = False
default shell = /bin/bash fallback_homedir = /home/%u
use_fully_qualified_names = False
nsswitch.conf has these lines for passwd, shadow and group:
passwd: files sss shadow: files sss group: files sss
/etc/pam.d/system-auth-ac (not hand edited at all)
#%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_fprintd.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_sss.so use_first_pass auth required pam_deny.so
account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so
session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so
nsswitch.conf and pam stack are configuread corectly. (due to authconfig)
The sssd-ad package in rhel6 update 6 is fairly new and as such I've been able to find limited web resources about its config directives.
You can read Jakub's blog post. "Enrolling an Active Directory RHEL-6 client machine using adcli" http://jhrozek.livejournal.com/3581.html
LS
On Thu, Jan 15, 2015 at 10:26:26PM +0100, Lukas Slebodnik wrote:
On (15/01/15 12:57), cprice@its.to wrote:
PLatform is RHEL 6 Update 6.
Relevent RPMS are :
sssd-ad-1.11.6-30.el6.x86_64 krb5-workstation-1.10.3-33.el6.x86_64
Pam was setup using " authconfig --enablesssd --enablesssdauth --enablemkhomedir --update"
I have test users successfully authenticating against a test domain server with both the test linux RHEL6U6 box and the Windows 2008R2 AD server on an isolated subnet.
After I login to the RHEL6U6 box with an AD user via either ssh, or via the console I cannot run 'su - <username>' to any other user, either AD based or local password file based. All I get is a 'incorrect password' error message.
That's interesting. Are you able to login with ssh to the machine with two+ users in parallel sessions.
Is there anything interesting in /var/log/secure?
I can see you have enabled debugging in domain section. You can filter the most critical message with next grep command.
grep -E': grep -E "(0x00[1-9]0)" /var/log/sssd/sssd_CORPTEST.LOCAL.log
Also -- do you initially log in from another unprivileged account or from root?
Jakub,
I have two unprivileged accounts configured on this test AD domain I am using, 'test1' and 'test2'.
test1's 'unix attributes' tab in AD is set to : uid 10000, gid is 10000 test2's 'unix attributes' tab in AD is set to : uid 10001, gid is 10000
tested scenarios:
1) Login via ssh with test1 account and run 'su -' or 'su - root' and supplying the root password when prompted the commands fail with 'incorrect password'. 2) Login via ssh with test2 account and run 'su -' or 'su - root' and supplying the root password when prompted the commands fail with 'incorrect password'. 3)Login via ssh with test1 and run 'su - test2' and supply the test2 password when prompted the command fails with 'incorrect password'. 4) Login via ssh with test2 and run 'su - test1' and supply the test1 password when prompted the command fails with 'incorrect password'
I have repeated the above 4 tests using the direct console login (the RHEL66 system is a VMware VM) with the same results. OS install is a freshly kickstarted RHEL66, no updates performed, selinux disabled.
Cheers.
On 1/16/2015 2:53 AM, Jakub Hrozek wrote:
Also -- do you initially log in from another unprivileged account or from root? _______________________________________________ sssd-users mailing list sssd-users@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users
On (16/01/15 07:23), Chris Price wrote:
Jakub,
I have two unprivileged accounts configured on this test AD domain I am using, 'test1' and 'test2'.
test1's 'unix attributes' tab in AD is set to : uid 10000, gid is 10000 test2's 'unix attributes' tab in AD is set to : uid 10001, gid is 10000
tested scenarios:
- Login via ssh with test1 account and run 'su -' or 'su - root' and
supplying the root password when prompted the commands fail with 'incorrect password'. 2) Login via ssh with test2 account and run 'su -' or 'su - root' and supplying the root password when prompted the commands fail with 'incorrect password'.
root is not handled by sssd. Are you sure you are using right password? If you are using right password then problem will probably not be in sssd.
3)Login via ssh with test1 and run 'su - test2' and supply the test2 password when prompted the command fails with 'incorrect password'. 4) Login via ssh with test2 and run 'su - test1' and supply the test1 password when prompted the command fails with 'incorrect password'
Did you change file /etc/pam.d/su-l ? Could you attach that file?
Is there something interesting in syslog and sssd log files?
LS
On 1/15/2015 2:26 PM, Lukas Slebodnik wrote:
That's interesting. Are you able to login with ssh to the machine with two+ users in parallel sessions.
Yes, see my reply to Jakub immediately prior to this list post.
Is there anything interesting in /var/log/secure?
Strangely, nothing at all gets logged to /var/log/secure when there is a su failure as described in my previous email to Jakub.
I can see you have enabled debugging in domain section. You can filter the most critical message with next grep command.
grep -E': grep -E "(0x00[1-9]0)" /var/log/sssd/sssd_CORPTEST.LOCAL.log
Cheers for that!
You can read Jakub's blog post. "Enrolling an Active Directory RHEL-6 client machine using adcli" http://jhrozek.livejournal.com/3581.html
I dont have adcli. On this stock rhel66 system.
Chris
On (16/01/15 07:35), Chris Price wrote:
On 1/15/2015 2:26 PM, Lukas Slebodnik wrote:
That's interesting. Are you able to login with ssh to the machine with two+ users in parallel sessions.
Yes, see my reply to Jakub immediately prior to this list post.
Is there anything interesting in /var/log/secure?
Strangely, nothing at all gets logged to /var/log/secure when there is a su failure as described in my previous email to Jakub.
I can see you have enabled debugging in domain section. You can filter the most critical message with next grep command.
grep -E': grep -E "(0x00[1-9]0)" /var/log/sssd/sssd_CORPTEST.LOCAL.log
Cheers for that!
You can read Jakub's blog post. "Enrolling an Active Directory RHEL-6 client machine using adcli" http://jhrozek.livejournal.com/3581.html
I dont have adcli. On this stock rhel66 system.
It is not in rhel6.6. It is just in epel6
LS
I'm trying to make this work without using something outside the rhel66 tree. Is adcli a necessity?
On 1/16/2015 7:38 AM, Lukas Slebodnik wrote:
On (16/01/15 07:35), Chris Price wrote:
On 1/15/2015 2:26 PM, Lukas Slebodnik wrote:
That's interesting. Are you able to login with ssh to the machine with two+ users in parallel sessions.
Yes, see my reply to Jakub immediately prior to this list post.
Is there anything interesting in /var/log/secure?
Strangely, nothing at all gets logged to /var/log/secure when there is a su failure as described in my previous email to Jakub.
I can see you have enabled debugging in domain section. You can filter the most critical message with next grep command.
grep -E': grep -E "(0x00[1-9]0)" /var/log/sssd/sssd_CORPTEST.LOCAL.log
Cheers for that!
You can read Jakub's blog post. "Enrolling an Active Directory RHEL-6 client machine using adcli" http://jhrozek.livejournal.com/3581.html
I dont have adcli. On this stock rhel66 system.
It is not in rhel6.6. It is just in epel6
LS _______________________________________________ sssd-users mailing list sssd-users@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users
On (16/01/15 07:40), Chris Price wrote:
I'm trying to make this work without using something outside the rhel66 tree. Is adcli a necessity?
BTW adcli and (relamd) is available on rhel7
You can also join the Linux client to the AD domain manually with samba utilities. https://fedorahosted.org/sssd/wiki/Configuring_sssd_with_ad_server#Joiningth...
LS
Thats fine. I read Jakub's article, and I am authenticating to my AD domain just fine, however 'su' isnt working for users authenticated via AD.
On 1/16/2015 7:55 AM, Lukas Slebodnik wrote:
On (16/01/15 07:40), Chris Price wrote:
I'm trying to make this work without using something outside the rhel66 tree. Is adcli a necessity?
BTW adcli and (relamd) is available on rhel7
You can also join the Linux client to the AD domain manually with samba utilities. https://fedorahosted.org/sssd/wiki/Configuring_sssd_with_ad_server#Joiningth...
LS _______________________________________________ sssd-users mailing list sssd-users@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users
RESOLVED
Turns out our default 'vanilla' RHEL66 kickstart build isnt so 'vanilla'. I spotted this gem in the post install kickstart log:
sed -i".orig" "s/^(#)(auth\s*required\s*pam_wheel.so.*)$/\2/" /etc/pam.d/su
I was unaware that people wanting to 'su' on our default systems had to be part of the 'wheel' group.
Problem was between the keyboard and this dimwitted admin all along. Mea Culpa.
Cheers and thanks for your help.
On 1/16/2015 7:55 AM, Lukas Slebodnik wrote:
On (16/01/15 07:40), Chris Price wrote:
I'm trying to make this work without using something outside the rhel66 tree. Is adcli a necessity?
BTW adcli and (relamd) is available on rhel7
You can also join the Linux client to the AD domain manually with samba utilities. https://fedorahosted.org/sssd/wiki/Configuring_sssd_with_ad_server#Joiningth...
LS _______________________________________________ sssd-users mailing list sssd-users@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Hi,
On Fri, Jan 16, 2015 at 2:27 AM, cprice@its.to wrote:
PLatform is RHEL 6 Update 6.
Relevent RPMS are :
sssd-ad-1.11.6-30.el6.x86_64 krb5-workstation-1.10.3-33.el6.x86_64
Pam was setup using " authconfig --enablesssd --enablesssdauth --enablemkhomedir --update"
I have test users successfully authenticating against a test domain server with both the test linux RHEL6U6 box and the Windows 2008R2 AD server on an isolated subnet.
After I login to the RHEL6U6 box with an AD user via either ssh, or via the console I cannot run 'su - <username>' to any other user, either AD based or local password file based. All I get is a 'incorrect password' error message.
In your client machine SeLinux is enabled (means enforcing)? Most of the time that could be the problem.
Please check that.
selinux is disabled completely on this host.
In your client machine SeLinux is enabled (means enforcing)? Most of the time that could be the problem.
Please check that.
sssd-users mailing list sssd-users@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users
sssd-users@lists.fedorahosted.org
-
Ashish Yadav -
Chris Price -
Jakub Hrozek -
Lukas Slebodnik