0

We have a Linux system running Centos 7 and have an issue with the screen lock. We have a multi-user environment where each user has their own account. The authentication is using our university active directory. Only local accounts use the passwd & shadow files and indeed if a local account locks the screen they are able to unlock it. All other users are authenticated using the AD and get authentication error when they try.

We are using sssd.
This from secure log:
Oct 30 08:59:54 b400 kcheckpass[94374]: pam_listfile(kscreensaver:auth): Refused user teach for service kscreensaver
Oct 30 08:59:55 b400 kcheckpass[94374]: pam_sss(kscreensaver:auth): authentication failure; logname=syin uid=1005 euid=1005 tty=:0 ruser= rhost= user=teach
Oct 30 08:59:55 b400 kcheckpass[94374]: pam_sss(kscreensaver:auth): received for user teach: 17 (Failure setting user credentials)
Oct 30 09:00:02 b400 gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by ouidad(uid=0)
Oct 30 09:00:03 b400 polkitd[663]: Registered Authentication Agent for unix-session:c243 (system bus name :1.20066 [/usr/bin/gnome-shell], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)

This from messages:
Oct 30 08:59:55 b400 [sssd[krb5_child[94379]]]: Preauthentication failed
Oct 30 08:59:55 b400 [sssd[krb5_child[94379]]]: Preauthentication failed
Oct 30 08:59:55 b400 [sssd[krb5_child[94379]]]: Preauthentication failed
Oct 30 08:59:55 b400 kcheckpass[94374]: Authentication failure for teach (invoked by uid 1005)

The sssd logs were either empty or provided no clues. What can I do to make sure on login it checks against the AD instead of the passwd/shadow files for screen unlocks?

| improve this question | | | | |
  • I don't understand. If a local account locked the screen, only this local account should be able to unlock it, shouldn't it? – Amessihel Nov 14 '19 at 21:58
  • Only our AD users get locked out on screen lock. – 3dalliance Nov 15 '19 at 0:17
0

We figured it out ... the kscreensaver file located in /etc/pam.d was misconfigured during a recovery update. We had backup files of the kscreensaver configuration file and simply copied using cp command to the original condition before the update.

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
# auth      required      pam_listfile.so file=/etc/allowed.nmr.users item=user sense=allow onerr=fail
auth        required      pam_env.so
auth        sufficient    pam_fprintd.so
auth        [default=1 success=ok] pam_localuser.so
auth        [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth        sufficient    pam_sss.so forward_pass
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so

password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_sss.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     optional      pam_oddjob_mkhomedir.so umask=0077
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so

systemctl rstart sssd

We restarted sssd and the unlock function for active directory users was restored.

| improve this answer | | | | |
  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review – jesse_b Nov 16 '19 at 16:35
  • @Jesse_b: note that this appears to be the OP with a partial answer. 3dalliance: there's no rush to post an answer. Please post Answers as complete answers, so that you don't risk running afoul of conscientious reviewers who might consider a partial answer a non-answer :) Thanks, all! – Jeff Schaller Nov 16 '19 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.