sssd: AD user cannot login in RHEL 7
I can switch to the mentioned domain user with su command from the server, but ssh login is failing.
The user domain group is already added in sssd.conf file under "simple_allow_groups"
The errors in /var/log/secure appear as follows:
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.35.x.x user=postlu522660
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: pam_sss(sshd:account): Access denied for user postlu522660: 6 (Permission denied)
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: Failed password for postl\u522660 from 138.35.x.x port 57903 ssh2
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: fatal: Access denied for user postl\\u522660 by PAM account configuration [preauth]
Understood that , it says failed passwd. But in real it is not the case, I am able to login to other windows machine with that domain user successfully. Same credentials I am entering here as well. So my input credentials are correct, but not sure why it is showing like that. Further I can see a authentication success initially , but end up with access Denied. Is there any configuration missing to allow a particular AD user or group to permit login to this server, other than adding corresponding group of that user to "simple_allow_groups"
configuration looks like below:
[root@xxx.xxxx.xxx ~]# realm list --all
POSTLl.xxxx.xxx
type: kerberos
realm-name: POSTL.xxxx.xxx
domain-name: POSTL.xxxx.xxx
configured: kerberos-member
server-software: active-directory
client-software: sssd
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
required-package: adcli
required-package: samba-common-tools
login-formats: %U@POSTL.xxxx.xxx
login-policy: allow-permitted-logins
permitted-logins:
permitted-groups: gu-adm-infra-unix-systems, gu-adm-esm%unix, gu-adm-epicon, domain%users
linux rhel ldap sssd
asked Jan 18 at 4:43
Prajith PPrajith P
172
add a comment |
I can switch to the mentioned domain user with su command from the server, but ssh login is failing.
The user domain group is already added in sssd.conf file under "simple_allow_groups"
The errors in /var/log/secure appear as follows:
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.35.x.x user=postlu522660
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: pam_sss(sshd:account): Access denied for user postlu522660: 6 (Permission denied)
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: Failed password for postl\u522660 from 138.35.x.x port 57903 ssh2
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: fatal: Access denied for user postl\\u522660 by PAM account configuration [preauth]
Understood that , it says failed passwd. But in real it is not the case, I am able to login to other windows machine with that domain user successfully. Same credentials I am entering here as well. So my input credentials are correct, but not sure why it is showing like that. Further I can see a authentication success initially , but end up with access Denied. Is there any configuration missing to allow a particular AD user or group to permit login to this server, other than adding corresponding group of that user to "simple_allow_groups"
configuration looks like below:
[root@xxx.xxxx.xxx ~]# realm list --all
POSTLl.xxxx.xxx
type: kerberos
realm-name: POSTL.xxxx.xxx
domain-name: POSTL.xxxx.xxx
configured: kerberos-member
server-software: active-directory
client-software: sssd
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
required-package: adcli
required-package: samba-common-tools
login-formats: %U@POSTL.xxxx.xxx
login-policy: allow-permitted-logins
permitted-logins:
permitted-groups: gu-adm-infra-unix-systems, gu-adm-esm%unix, gu-adm-epicon, domain%users
linux rhel ldap sssd
asked Jan 18 at 4:43
Prajith PPrajith P
172
please add that information to the question above and delete the comment
– jsotola
Jan 18 at 7:12
Title should be SSHD, or SSH , not sssd.
– jayooin
Jan 18 at 9:21
Could you please post your/etc/sssd/sssd.conf? @jayooin No, it's really problem of sssd, not SSH.
– Jaroslav Kucera
Jan 18 at 12:03
add a comment |
I can switch to the mentioned domain user with su command from the server, but ssh login is failing.
The user domain group is already added in sssd.conf file under "simple_allow_groups"
The errors in /var/log/secure appear as follows:
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.35.x.x user=postlu522660
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: pam_sss(sshd:account): Access denied for user postlu522660: 6 (Permission denied)
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: Failed password for postl\u522660 from 138.35.x.x port 57903 ssh2
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: fatal: Access denied for user postl\\u522660 by PAM account configuration [preauth]
Understood that , it says failed passwd. But in real it is not the case, I am able to login to other windows machine with that domain user successfully. Same credentials I am entering here as well. So my input credentials are correct, but not sure why it is showing like that. Further I can see a authentication success initially , but end up with access Denied. Is there any configuration missing to allow a particular AD user or group to permit login to this server, other than adding corresponding group of that user to "simple_allow_groups"
configuration looks like below:
[root@xxx.xxxx.xxx ~]# realm list --all
POSTLl.xxxx.xxx
type: kerberos
realm-name: POSTL.xxxx.xxx
domain-name: POSTL.xxxx.xxx
configured: kerberos-member
server-software: active-directory
client-software: sssd
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
required-package: adcli
required-package: samba-common-tools
login-formats: %U@POSTL.xxxx.xxx
login-policy: allow-permitted-logins
permitted-logins:
permitted-groups: gu-adm-infra-unix-systems, gu-adm-esm%unix, gu-adm-epicon, domain%users
linux rhel ldap sssd
asked Jan 18 at 4:43
Prajith PPrajith P
172
I can switch to the mentioned domain user with su command from the server, but ssh login is failing.
The user domain group is already added in sssd.conf file under "simple_allow_groups"
The errors in /var/log/secure appear as follows:
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.35.x.x user=postlu522660
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: pam_sss(sshd:account): Access denied for user postlu522660: 6 (Permission denied)
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: Failed password for postl\u522660 from 138.35.x.x port 57903 ssh2
Jan 18 04:10:18 m1-vlp0006 sshd[6420]: fatal: Access denied for user postl\\u522660 by PAM account configuration [preauth]
Understood that , it says failed passwd. But in real it is not the case, I am able to login to other windows machine with that domain user successfully. Same credentials I am entering here as well. So my input credentials are correct, but not sure why it is showing like that. Further I can see a authentication success initially , but end up with access Denied. Is there any configuration missing to allow a particular AD user or group to permit login to this server, other than adding corresponding group of that user to "simple_allow_groups"
configuration looks like below:
[root@xxx.xxxx.xxx ~]# realm list --all
POSTLl.xxxx.xxx
type: kerberos
realm-name: POSTL.xxxx.xxx
domain-name: POSTL.xxxx.xxx
configured: kerberos-member
server-software: active-directory
client-software: sssd
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
required-package: adcli
required-package: samba-common-tools
login-formats: %U@POSTL.xxxx.xxx
login-policy: allow-permitted-logins
permitted-logins:
permitted-groups: gu-adm-infra-unix-systems, gu-adm-esm%unix, gu-adm-epicon, domain%users
linux rhel ldap sssd
linux rhel ldap sssd
asked Jan 18 at 4:43
Prajith PPrajith P
172
asked Jan 18 at 4:43
Prajith PPrajith P
172
edited Jan 18 at 8:49
Prajith P
asked Jan 18 at 4:43
Prajith PPrajith P
172
asked Jan 18 at 4:43
Prajith PPrajith P
172
asked Jan 18 at 4:43
Prajith PPrajith P
172
172
please add that information to the question above and delete the comment
– jsotola
Jan 18 at 7:12
Title should be SSHD, or SSH , not sssd.
– jayooin
Jan 18 at 9:21
Could you please post your/etc/sssd/sssd.conf? @jayooin No, it's really problem of sssd, not SSH.
– Jaroslav Kucera
Jan 18 at 12:03
add a comment |
please add that information to the question above and delete the comment
– jsotola
Jan 18 at 7:12
Title should be SSHD, or SSH , not sssd.
– jayooin
Jan 18 at 9:21
Could you please post your/etc/sssd/sssd.conf? @jayooin No, it's really problem of sssd, not SSH.
– Jaroslav Kucera
Jan 18 at 12:03
please add that information to the question above and delete the comment
– jsotola
Jan 18 at 7:12
please add that information to the question above and delete the comment
– jsotola
Jan 18 at 7:12
Title should be SSHD, or SSH , not sssd.
– jayooin
Jan 18 at 9:21
Title should be SSHD, or SSH , not sssd.
– jayooin
Jan 18 at 9:21
Could you please post your
/etc/sssd/sssd.conf ? @jayooin No, it's really problem of sssd, not SSH.– Jaroslav Kucera
Jan 18 at 12:03
Could you please post your
/etc/sssd/sssd.conf ? @jayooin No, it's really problem of sssd, not SSH.– Jaroslav Kucera
Jan 18 at 12:03
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f495220%2fsssd-ad-user-cannot-login-in-rhel-7%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f495220%2fsssd-ad-user-cannot-login-in-rhel-7%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
please add that information to the question above and delete the comment
– jsotola
Jan 18 at 7:12
Title should be SSHD, or SSH , not sssd.
– jayooin
Jan 18 at 9:21
Could you please post your
/etc/sssd/sssd.conf? @jayooin No, it's really problem of sssd, not SSH.– Jaroslav Kucera
Jan 18 at 12:03