1

I can switch to the mentioned domain user with su command from the server, but ssh login is failing. The user domain group is already added in sssd.conf file under "simple_allow_groups"

The errors in /var/log/secure appear as follows:

Jan 18 04:10:18 m1-vlp0006 sshd[6420]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.35.x.x user=postl\u522660
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: pam_sss(sshd:account): Access denied for user postl\u522660: 6 (Permission denied)
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: Failed password for postl\\u522660 from 138.35.x.x port 57903 ssh2
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: fatal: Access denied for user postl\\\\u522660 by PAM account configuration [preauth]

Understood that , it says failed passwd. But in real it is not the case, I am able to login to other windows machine with that domain user successfully. Same credentials I am entering here as well. So my input credentials are correct, but not sure why it is showing like that. Further I can see a authentication success initially , but end up with access Denied. Is there any configuration missing to allow a particular AD user or group to permit login to this server, other than adding corresponding group of that user to "simple_allow_groups"

configuration looks like below:

[root@xxx.xxxx.xxx ~]# realm list --all
POSTLl.xxxx.xxx
  type: kerberos
  realm-name: POSTL.xxxx.xxx
  domain-name: POSTL.xxxx.xxx
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common-tools
  login-formats: %U@POSTL.xxxx.xxx
  login-policy: allow-permitted-logins
  permitted-logins:
  permitted-groups: gu-adm-infra-unix-systems, gu-adm-esm%unix, gu-adm-epicon, domain%users
3
  • Title should be SSHD, or SSH , not sssd.
    – jayooin
    Jan 18, 2019 at 9:21
  • 1
    Could you please post your /etc/sssd/sssd.conf ? @jayooin No, it's really problem of sssd, not SSH. Jan 18, 2019 at 12:03
  • Looks like an issue with PAM for sshd (sshd:auth succeeds, so sssd seems to be authenticating correctly, but sshd:account fails, suggesting it doesn't know how to instantiate the account that's been authenticated). I'd need to see the PAM configuration for sshd to be sure.
    – roaima
    May 13, 2020 at 11:34

3 Answers 3

0

I have faced a similar issue today, not sure how helps this to you.

I was able to login with su (after root login), but not able to take ssh directly with the ActiveDirectory Users.

I have gone through couple of articles online, and just restarted the SSSd service it got started working.

 systemctl restart  sssd
1
  • If you've got the same sort of permitted-groups at the end of your sssd.conf you need to ensure your target user really is a member of those groups. That's an AD issue. Otherwise ask a new question, possibly referencing this question here as not solving your problem.
    – roaima
    Jun 22, 2020 at 10:18
0

This is a known problem by Red Hat. It is a simple omission of a single line in the /etc/sssd/sssd.conf file and is expected to be corrected in the V6.4 Red Hat release.

The following line needs to be placed in the domain section that is used for access to the AD server:

krb5_canonicalize = false

Then sssd must be restarted...

service sssd restart
-1

Actually, I have faced the same issue for Centos 8 NIS environment and following the pam module I have commented out in the following 2 files and I am able to login with kerberos user authentication. This might be helping out someone who is having login issue for the following error logs.

Unix_chkpwd: could not obtain user info (User)
sshd[19550]: Failed password for [user] by IP
fatal: Access denied for user [user] by PAM account configuration [preauth]
vi /etc/pam.d/password-auth



#auth        sufficient                                   pam_unix.so nullo try_first_pass

#account     required                                     pam_unix.so


#password    sufficient                                   pam_unix.so sha512 shadow 
#session     required                                     pam_unix.so

vi system-auth


#auth        sufficient                                   pam_unix.so nullok try_first_pass

#account     required                                     pam_unix.so
#password    sufficient                                   pam_unix.so sha512 shadow nullok try_first_pass use_authtok

#session     required                                     pam_unix.so

1
  • 1
    Commenting out pam_unix.so prevents you from logging in with local credentials. Not a good idea. Jan 28, 2020 at 21:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.