I am not able to login from one server to another node but not vice-versa (let's say from B --> A SSH login works but A --> B login fails). The user is authenticated via remote LDAP server and sssd configuration /etc/sssd/sssd.conf is properly done to access LDAP. Passwordless SSH connectivity is setup between both the servers.

These are the following observations:

  • ldapsearch for that user returns result from both the servers and ldap server is reachable
  • no AllowUsers or deny parameter in the /etc/ssh/sshd_config file in both the servers
  • sss method is configured properly for password, shadow, and group in /etc/nsswitch.conf
  • tried login after stopping the iptables service in the problematic server rules out the possibility of firewall rule's involvement in blocking this
  • SELinux status is disabled, so it has no role to play here
  • pam_ldap.so PAM rule is not found in the files under /etc/pam.d directory in both the servers

Still not able to figure out the reason for the connectivity failure.

1 Answer 1


The issue is fixed by doing the following:

added this line ldap_tls_reqcert=allow to the end of /etc/sssd/sssd.conf and copied /root/LDAP/ca.crt from ldap server to the particular problematic node's /etc/pki/ca-trust/extracted/pem/ca.crt and restarted the sssd service, service restart sssd

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .