I can switch to the mentioned domain user with su command from the server, but ssh login is failing. The user domain group is already added in sssd.conf file under "simple_allow_groups"

The errors in /var/log/secure appear as follows:

Jan 18 04:10:18 m1-vlp0006 sshd[6420]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.35.x.x user=postl\u522660
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: pam_sss(sshd:account): Access denied for user postl\u522660: 6 (Permission denied)
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: Failed password for postl\\u522660 from 138.35.x.x port 57903 ssh2
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: fatal: Access denied for user postl\\\\u522660 by PAM account configuration [preauth]

Understood that , it says failed passwd. But in real it is not the case, I am able to login to other windows machine with that domain user successfully. Same credentials I am entering here as well. So my input credentials are correct, but not sure why it is showing like that. Further I can see a authentication success initially , but end up with access Denied. Is there any configuration missing to allow a particular AD user or group to permit login to this server, other than adding corresponding group of that user to "simple_allow_groups"

configuration looks like below:

[root@xxx.xxxx.xxx ~]# realm list --all
  type: kerberos
  realm-name: POSTL.xxxx.xxx
  domain-name: POSTL.xxxx.xxx
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common-tools
  login-formats: %U@POSTL.xxxx.xxx
  login-policy: allow-permitted-logins
  permitted-groups: gu-adm-infra-unix-systems, gu-adm-esm%unix, gu-adm-epicon, domain%users
  • please add that information to the question above and delete the comment – jsotola Jan 18 at 7:12
  • Title should be SSHD, or SSH , not sssd. – jayooin Jan 18 at 9:21
  • Could you please post your /etc/sssd/sssd.conf ? @jayooin No, it's really problem of sssd, not SSH. – Jaroslav Kucera Jan 18 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.