1

There are two RHEL 8 servers which have been provisioned from the same template, with some manual fix and tweaking done manually on the first server only. They allow SSH user authentication via a remote LDAP server, and have been configured with authselect:

authselect select sssd --force

The first server works perfectly, while on the second one the SSH authentication fails. I'm looking to find the difference between them, because their LDAP, PAM, sssd, and nscd configs appear the same.

EDIT 11/6: The nslcd daemon is inactive; it has the default config, identical on both servers.
It is also worth noting that getent passwd correctly returns all LDAP users, but these users cannot login via SSH. The sshd config is the same, too.


By reading the sssd logs, I found out that the first server calls (correctly) ldap_search_ext with

[(&(uid=dr01)(objectclass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))][dc=mydomain,dc=org]

while the second one uses (failing) the search

[(&(uid=dr01)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))][dc=mydomain,dc=org]

So, on the second server the query includes an additional (uid=*). It also refers to BE_REQ_USER vs BE_REQ_INITGROUPS in the first search (see logs below). This returns zero results.

So, I'd like to know where the call to ldap_search_ext is defined.


Here is an excerpt of the logs from the first server:

(Fri Jun  7 15:15:46 2019) [sssd[be[mydomain.org]]] [dp_get_account_info_send] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=dr01@mydomain.org]
(Fri Jun  7 15:15:46 2019) [sssd[be[mydomain.org]]] [sss_domain_get_state] (0x1000): Domain mydomain.org is Active
(Fri Jun  7 15:15:46 2019) [sssd[be[mydomain.org]]] [dp_attach_req] (0x0400): DP Request [Initgroups #13]: New request. Flags [0x0001].
(Fri Jun  7 15:15:46 2019) [sssd[be[mydomain.org]]] [dp_attach_req] (0x0400): Number of active DP request: 1
(Fri Jun  7 15:15:46 2019) [sssd[be[mydomain.org]]] [sss_domain_get_state] (0x1000): Domain mydomain.org is Active
(Fri Jun  7 15:15:46 2019) [sssd[be[mydomain.org]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [dc=mydomain,dc=org]
(Fri Jun  7 15:15:46 2019) [sssd[be[mydomain.org]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=dr01)(objectclass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))][dc=mydomain,dc=org].
(Fri Jun  7 15:15:46 2019) [sssd[be[mydomain.org]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
(Fri Jun  7 15:15:46 2019) [sssd[be[mydomain.org]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uid]
(Fri Jun  7 15:15:46 2019) [sssd[be[mydomain.org]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword]
(Fri Jun  7 15:15:46 2019) [sssd[be[mydomain.org]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber]
(Fri Jun  7 15:15:46 2019) [sssd[be[mydomain.org]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber]
(...)
(Fri Jun  7 15:20:50 2019) [sssd[be[mydomain.org]]] [sdap_search_user_process] (0x0400): Search for users, returned 1 results.

and the second one:

(Fri Jun  7 15:20:50 2019) [sssd[be[mydomain.org]]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=dr01@mydomain.org]
(Fri Jun  7 15:20:50 2019) [sssd[be[mydomain.org]]] [dp_attach_req] (0x0400): DP Request [Account #8]: New request. Flags [0x0001].
(Fri Jun  7 15:20:50 2019) [sssd[be[mydomain.org]]] [dp_attach_req] (0x0400): Number of active DP request: 1
(Fri Jun  7 15:20:50 2019) [sssd[be[mydomain.org]]] [sss_domain_get_state] (0x1000): Domain mydomain.org is Active
(Fri Jun  7 15:20:50 2019) [sssd[be[mydomain.org]]] [sdap_search_user_next_base] (0x0400): Searching for users with base [dc=mydomain,dc=org]
(Fri Jun  7 15:20:50 2019) [sssd[be[mydomain.org]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=dr01)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))][dc=mydomain,dc=org].
(Fri Jun  7 15:20:50 2019) [sssd[be[mydomain.org]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
(Fri Jun  7 15:20:50 2019) [sssd[be[mydomain.org]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uid]
(Fri Jun  7 15:20:50 2019) [sssd[be[mydomain.org]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword]
(Fri Jun  7 15:20:50 2019) [sssd[be[mydomain.org]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber]
(Fri Jun  7 15:20:50 2019) [sssd[be[mydomain.org]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber]
1

Found the problem. The sssd configuration contains the line

ldap_access_filter = (host=<hostname>.mydomain.org)

where hostname is the local host name for each server. However, the second server wasn't referenced in the LDAP server, only the first one was. Adding an entry for the second server on the LDAP solved the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.