I can join machines to a realm with Ubuntu no problem. So using the exact same steps for CentOS 7.7, I am able to join the domain and id users... but I can't ssh in!

Steps I use only differ with slight difference in package requirements. Here are my CentOS AD join steps:

sudo dnf install net-tools samba sssd krb5-workstation krb5-server sssd-krb5 sssd-ad nfs-utils oddjob-mkhomedir

/etc/hostname #contains:
/etc/hosts #contains: hostname

-set SELINUX to permissive in /etc/selinux/config

Edit /etc/krb5.conf

sudo kinit domain_administrator

Edit /etc/samba/smb.conf

systemctl stop sssd

Edit /etc/sssd/sssd.conf

sudo chmod 600 /etc/sssd/sssd.conf

sudo net ads join -Udomain_administrator

Add this line to /etc/pam.d/common-session
session    required    pam_mkhomedir.so skel=/etc/skel/ umask=0022

systemctl start sssd

systemctl enable sssd

id moreilly
-Succesfully outputs id info

ssh banana@hostname
Permission denied, please try again.

But when I try to su or ssh user@centosbox, it says "Permission denied, please try again."

If I change and enable these lines in /etc/ssh/sshd_config, then I can ssh in BUT no home directory is created:

# Kerberos options

#default is no
KerberosAuthentication yes

KerberosOrLocalPasswd yes
KerberosTicketCleanup yes

#default no
KerberosGetAFSToken yes

KerberosUseKuserok yes

# GSSAPI options
GSSAPIAuthentication yes

GSSAPICleanupCredentials yes

Home directory is created automatically on Ubuntu but not on CentOS. Why would I need to go enable these Kerberos and GSSAPI directives in sshd_config for CentOS and not on Ubuntu?

In the end:

  1. I dont know why I would need to edit sshd_config on CentOS and not Ubuntu.
  2. If I do have to enable these sshd_config directives, then I don't what more to do to get home directories being enabled
  • Have you changed the PAM auth configuration?
    – stefan0xC
    Mar 10 at 19:30
  • @stefan0xC I read about people checking /etc/pam.d/login and /etc/pam.d/sshd but those articles were all about pam_Tally and pam_Tally isnt mentioned in either of the files. They also mention, grep sss /etc/pam.d/system-auth-ac and grep sss /etc/pam.d/password-auth-ac but both of these files don't contain "sss" at all..
    – melonpine
    Mar 10 at 19:36
  • You don’t want to set the Kerberos options in sshd_config, just gssapi, and certainly not the AFS token option unless you are using OpenAFS. You do want pam_sss in your pam settings, so I’m not sure why you don’t have that
    – jsbillings
    Mar 10 at 21:21
  • You should be using pam_oddjob_mkhomedir, which works fine with SELinux (which should be on anyway). See Dan Walsh’s post about it here: danwalsh.livejournal.com/69837.html
    – jsbillings
    Mar 10 at 21:28


session    required    pam_mkhomedir.so skel=/etc/skel/ umask=0022

at the top of all session directives if you haven't already done so.

  • Hi thanks. I actually do that already.. but only in /etc/pam.d/common-session. Are there other files to place that directive? Do you know why I would have to enable certain Kerberos and GSSAPI params in /etc/ssh/sshd_config on centos but I dont have to do that on Ubuntu?
    – melonpine
    Mar 10 at 19:47
  • 2
    If you do that in /etc/pam.d/common-session you need to ensure that the PAM files relating to your login (so ssh(d), for example) include that common-session file
    – roaima
    Mar 10 at 20:33
  • 1
    OK. Added session required pam_mkhomedir.so skel=/etc/skel/ umask=0022 to /etc/pam.d/sshd and it works! I still don't understand why between Ubuntu and CentOS I have to make any edits at all to sshd_config however
    – melonpine
    Mar 10 at 21:30
  • 1
    /etc/pam.d/common-session is a debianism, and isn’t used at all in a normal CentOS system. You probably don’t need to make most of the changes you made to sshd_config.
    – jsbillings
    Mar 10 at 22:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.