I've setup my samba4 DC to get account information from a central AD provider via sssd. What I'd like to do now is permit some subset of these users to login via ssh (to linux machines) or via RDP (to windows machines).
I can get passwd information from the AD provider using
getent passwd <name>. Unfortunately this is coming in with params that don't seem to work locally:
The errors in
/var/log/secure appear as follows:
Jul 16 03:42:46 beanbag sshd: User johndoe not allowed because shell 212578 does not exist Jul 16 03:42:46 beanbag sshd: input_userauth_request: invalid user johndoe Jul 16 03:42:50 beanbag sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=server.edu user=johndoe Jul 16 03:42:51 beanbag sshd: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=server.edu user=johndoe Jul 16 03:42:51 beanbag sshd: pam_sss(sshd:auth): received for user johndoe: 6 (Permission denied) Jul 16 03:42:53 beanbag sshd: Failed password for invalid user johndoe from 10.95.20.20 port 1714 ssh2
What step(s) have I missed in getting sssd (and it's kin) setup?
CentOS 6.4 (x64)
NOTE: I have run
authconfig --enablesssd --enablesssdauth --update.
EDIT: Fixed the first part of this problem - 'shell does not exist'.
/etc/sssd/sssd.conf add these lines to the [nss] section:
allowed_shells = /bin/bash shell_fallback = /bin/bash
Now it attempts to create the (invalid) home directory \\nafs2\u204\johndoe and then returns a 'This account is currently not available.' error.
EDIT: If you use the entry
override_shell = /bin/bash (or whatever) in your domain listing it will fix the above problem.