EDIT 1: added solution, pam was faulty

i'm trying to set up freeipa client on debian 9 client using this guide:


Current setup:

  • Freeipa service is installed on centos 7.6 (ipa-server 4.6.4-10.el7.centos.2)
  • Debian 9 on which i am trying to set up as client has installed selinux and configured in permissive mode, sssd and sssd-krb5 in version 1.15.0-3
  • I am able to login on local (non freeipa) users which existed on the system before installation/configuration (intended behaviour)

I am not able to login via freeipa newly created user (lines appear when i'm trying ssh newuser@host). Error:

==> sssd_dev.company.log <==
(timestamp) [sssd[be[dev.company]]] [sysdb_get_real_name] (0x0040): Cannot find user [nobody@dev.company] in cache
(timestamp) [sssd[be[dev.company]]] [ipa_id_get_account_info_orig_done] (0x0080): Object not found, ending request
(timestamp) [sssd[be[dev.company]]] [krb5_auth_send] (0x0020): Illegal zero-length authtok for user [newuser@dev.company]

Configs below:


config_file_version = 2
services = nss, pam, sudo, ssh
domains = dev.company
debug_level = 3
debug_level = 3
debug_level = 3
debug_level = 3
debug_level = 3
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = dev.company
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = company-dev-test-01.dev.company
chpass_provider = ipa
ipa_server = freeipa.dev.company
ldap_tls_cacert = /etc/ipa/ca.crt
debug_level = 3


 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 master_kdc = FILE:/var/log/krb5masterkdc.log
 admin_server = FILE:/var/log/kadmind.log
 kpasswd_server = FILE:/var/log/kpasswdserver.log

 default_realm = DEV.COMPANY
 dns_lookup_realm = false
 dns_lookup_kdc = false
 rdns = false
 ticket_lifetime = 24h
 forwardable = yes
 allow_weak_crypto = false

  kdc = freeipa.dev.company:88
  master_kdc = freeipa.dev.company:88
  admin_server = freeipa.dev.company:749
  kpasswd_server = freeipa.dev.company:464
  default_domain = dev.company

 .dev.company = DEV.COMPANY
 dev.company = DEV.COMPANY


account     [default=bad success=ok user_unknown=ignore]      pam_sss.so forward_pass use_first_pass
account     [success=1 new_authtok_reqd=done default=ignore]  pam_unix.so
account     requisite                                         pam_deny.so
account     required                                          pam_permit.so
account     sufficient                                        pam_localuser.so

/etc/pam.d/common-auth (old, not working)

auth        [success=2 default=ignore]  pam_sss.so forward_pass use_first_pass
auth        [success=1 default=ignore]  pam_unix.so nullok_secure
auth        requisite                   pam_deny.so
auth        required                    pam_permit.so

/etc/pam.d/common-auth (new, working)

auth        [success=2 default=ignore]  pam_sss.so forward_pass
auth        [success=1 default=ignore]  pam_unix.so nullok_secure try_first_pass
auth        requisite                   pam_deny.so
auth        required                    pam_permit.so


password    [success=2 default=ignore]  pam_sss.so forward_pass
password    [success=1 default=ignore]  pam_unix.so obscure sha512
password    requisite                   pam_deny.so
password    required                    pam_permit.so


session     [default=1]     pam_permit.so
session     requisite       pam_deny.so
session     required        pam_mkhomedir.so
session     required        pam_permit.so
session     required        pam_unix.so 
session     optional        pam_sss.so
  • Pam configuration was faulty - i reedited my original post with both old, not working config part and new - working – anon628462 Feb 28 at 7:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.