Re: [Freeipa-users] Issues after setup

[Jakub Hrozek]

On Wed, Apr 10, 2013 at 02:49:46PM -0400, Shawn wrote:
> Yep, sure does. Thanks much.
> 
> If selinux is disabled, why does it care?
> 

It's an SSSD bug:
https://bugzilla.redhat.com/show_bug.cgi?id=914433

We didn't realize that SELinux disabled might mean that the directory is
not there at all. Luckily there is a simple workaround.

___
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Re: [Freeipa-users] Issues after setup

[Shawn]

Yep, sure does. Thanks much.

If selinux is disabled, why does it care?




On Wed, Apr 10, 2013 at 2:37 PM, Jakub Hrozek  wrote:

> On Wed, Apr 10, 2013 at 02:34:06PM -0400, Shawn wrote:
> > [root@freeclient1 sssd]# sestatus
> > SELinux status: disabled
> > [root@freeclient1 sssd]# ls -ldZ /etc/selinux/
> > drwxr-xr-x root root ?/etc/selinux/
> > [root@freeclient1 sssd]#
>
> I take it there is no directory /etc/selinux/targeted/logins (or
> /etc/selinux/targeted/ for that matter?)
>
> Does mkdir -p /etc/selinux/targeted/logins solve things for you?
>
> >
> >
> >
> > On Wed, Apr 10, 2013 at 2:31 PM, Jakub Hrozek 
> wrote:
> >
> > > On Wed, Apr 10, 2013 at 02:27:36PM -0400, Shawn wrote:
> > > > (Wed Apr 10 14:22:45 2013) [sssd[pam]] [write_selinux_login_file]
> > > (0x0040):
> > > > creating the temp file for SELinux data failed.
> > > > /etc/selinux/targeted/logins/staajtlQ108(Wed Apr 10 14:22:45 2013)
> > > > [sssd[pam]] [pam_reply] (0x0100): blen: 30
> > >
> > > I think this is the smoking gun.
> > >
> > > What state is SELinux in? (run sestate)
> > > Are there any AVC denials that would indicate the directory is
> > > mislabeled?
> > >
> > > What is the output of:
> > > # ls -ldZ /etc/selinux/targeted/ /etc/selinux/targeted/logins
> > >
> >
> >
> >
> > --
> > *- Shawn Taaj*
>



-- 
*- Shawn Taaj*
___
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Re: [Freeipa-users] Issues after setup

[Jakub Hrozek]

On Wed, Apr 10, 2013 at 02:34:06PM -0400, Shawn wrote:
> [root@freeclient1 sssd]# sestatus
> SELinux status: disabled
> [root@freeclient1 sssd]# ls -ldZ /etc/selinux/
> drwxr-xr-x root root ?/etc/selinux/
> [root@freeclient1 sssd]#

I take it there is no directory /etc/selinux/targeted/logins (or
/etc/selinux/targeted/ for that matter?)

Does mkdir -p /etc/selinux/targeted/logins solve things for you?

> 
> 
> 
> On Wed, Apr 10, 2013 at 2:31 PM, Jakub Hrozek  wrote:
> 
> > On Wed, Apr 10, 2013 at 02:27:36PM -0400, Shawn wrote:
> > > (Wed Apr 10 14:22:45 2013) [sssd[pam]] [write_selinux_login_file]
> > (0x0040):
> > > creating the temp file for SELinux data failed.
> > > /etc/selinux/targeted/logins/staajtlQ108(Wed Apr 10 14:22:45 2013)
> > > [sssd[pam]] [pam_reply] (0x0100): blen: 30
> >
> > I think this is the smoking gun.
> >
> > What state is SELinux in? (run sestate)
> > Are there any AVC denials that would indicate the directory is
> > mislabeled?
> >
> > What is the output of:
> > # ls -ldZ /etc/selinux/targeted/ /etc/selinux/targeted/logins
> >
> 
> 
> 
> -- 
> *- Shawn Taaj*

___
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Re: [Freeipa-users] Issues after setup

[Shawn]

[root@freeclient1 sssd]# sestatus
SELinux status: disabled
[root@freeclient1 sssd]# ls -ldZ /etc/selinux/
drwxr-xr-x root root ?/etc/selinux/
[root@freeclient1 sssd]#



On Wed, Apr 10, 2013 at 2:31 PM, Jakub Hrozek  wrote:

> On Wed, Apr 10, 2013 at 02:27:36PM -0400, Shawn wrote:
> > (Wed Apr 10 14:22:45 2013) [sssd[pam]] [write_selinux_login_file]
> (0x0040):
> > creating the temp file for SELinux data failed.
> > /etc/selinux/targeted/logins/staajtlQ108(Wed Apr 10 14:22:45 2013)
> > [sssd[pam]] [pam_reply] (0x0100): blen: 30
>
> I think this is the smoking gun.
>
> What state is SELinux in? (run sestate)
> Are there any AVC denials that would indicate the directory is
> mislabeled?
>
> What is the output of:
> # ls -ldZ /etc/selinux/targeted/ /etc/selinux/targeted/logins
>



-- 
*- Shawn Taaj*
___
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Re: [Freeipa-users] Issues after setup

[Jakub Hrozek]

On Wed, Apr 10, 2013 at 02:27:36PM -0400, Shawn wrote:
> (Wed Apr 10 14:22:45 2013) [sssd[pam]] [write_selinux_login_file] (0x0040):
> creating the temp file for SELinux data failed.
> /etc/selinux/targeted/logins/staajtlQ108(Wed Apr 10 14:22:45 2013)
> [sssd[pam]] [pam_reply] (0x0100): blen: 30

I think this is the smoking gun.

What state is SELinux in? (run sestate)
Are there any AVC denials that would indicate the directory is
mislabeled?

What is the output of:
# ls -ldZ /etc/selinux/targeted/ /etc/selinux/targeted/logins

___
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Re: [Freeipa-users] Issues after setup

[Shawn]

(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sss_parse_name_for_domains]
(0x0200): name 'staaj' matched without domain, user is staaj
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sss_parse_name_for_domains]
(0x0200): using default domain [(null)]
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): command:
PAM_ACCT_MGMT
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): domain:
not set
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): user:
staaj
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): service:
sshd
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): ruser:
not set
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): rhost:
50.59.202.7
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): authtok
type: 0
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): authtok
size: 0
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100):
newauthtok type: 0
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100):
newauthtok size: 0
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): priv: 1
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): cli_pid:
23185
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sss_ncache_check_str] (0x2000):
Checking negative cache for [NCE/USER/company-dev.com/staaj]
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sss_dp_issue_request] (0x0400):
Issuing request for [0x41b300:3:st...@vocal-dev.com]
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sss_dp_get_account_msg] (0x0400):
Creating request for [company-dev.com][3][1][name=staaj]
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sbus_add_timeout] (0x2000): 0xb39fd0
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sss_dp_internal_get_send] (0x0400):
Entering request [0x41b300:3:st...@company-dev.com]
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sbus_remove_timeout] (0x2000):
0xb39fd0
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn:
B35A10
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sbus_dispatch] (0x4000):
Dispatching.
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sss_dp_get_reply] (0x1000): Got
reply from Data Provider - DP error code: 0 errno: 0 error message: Success



(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending
request with the following data:
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): command:
PAM_ACCT_MGMT
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): domain:
company-dev.com
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): user:staaj
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): service:
sshd
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): ruser:
not set
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): rhost:
50.59.202.7
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): authtok
type: 0
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): authtok
size: 0
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100):
newauthtok type: 0
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100):
newauthtok size: 0
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): priv: 1
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_print_data] (0x0100): cli_pid:
23185
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sbus_add_timeout] (0x2000): 0xb41990
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [pam_dom_forwarder] (0x0100):
pam_dp_send_req returned 0
(Wed Apr 10 14:22:45 2013) [sssd[pam]] [sss_dp_req_destructor] (0x0400):
Deleting request: [0x41b300:3:st...@company-dev.com]

only thing i see about selinux is here

(Wed Apr 10 14:22:45 2013) [sssd[pam]] [write_selinux_login_file] (0x0040):
creating the temp file for SELinux data failed.
/etc/selinux/targeted/logins/staajtlQ108(Wed Apr 10 14:22:45 2013)
[sssd[pam]] [pam_reply] (0x0100): blen: 30

# rpm -qa |grep sssd
sssd-client-1.9.2-82.4.el6_4.x86_64
sssd-1.9.2-82.4.el6_4.x86_64





On Wed, Apr 10, 2013 at 2:15 PM, Jakub Hrozek  wrote:

> On Wed, Apr 10, 2013 at 02:11:14PM -0400, Rob Crittenden wrote:
> > Shawn wrote:
> > >[root@freeipa ~]# ipa hbactest --user=myuser --host=my.fqdn.
> --service=sshd
> > >
> > >Access granted: True
> > >
> > >   Matched rules: allow_all
> > >[root@freeipa ~]#
> > >
> > >
> > >└─> ssh myus...@ec2-54-xxx.xxx.compute-1.amazonaws.com
> > > -i
> > >/home/user/.ssh/key
> > >Connection closed by 54x.x.x.x
> > >
> > >(client server logs)
> > >Apr 10 13:59:04 ip-10-152-174-17 sshd[22868]: pam_sss(sshd:account):
> > >Access denied for user myuser: 4 (System error)
> > >Apr 10 13:59:04 ip-10-152-174-17 sshd[22872]: fatal: Access denied for
> > >user client by PAM account configuration
> > >
> > >
> > >(client ipa versions)
> > >

Re: [Freeipa-users] Issues after setup

[Jakub Hrozek]

On Wed, Apr 10, 2013 at 02:11:14PM -0400, Rob Crittenden wrote:
> Shawn wrote:
> >[root@freeipa ~]# ipa hbactest --user=myuser --host=my.fqdn. --service=sshd
> >
> >Access granted: True
> >
> >   Matched rules: allow_all
> >[root@freeipa ~]#
> >
> >
> >└─> ssh myus...@ec2-54-xxx.xxx.compute-1.amazonaws.com
> > -i
> >/home/user/.ssh/key
> >Connection closed by 54x.x.x.x
> >
> >(client server logs)
> >Apr 10 13:59:04 ip-10-152-174-17 sshd[22868]: pam_sss(sshd:account):
> >Access denied for user myuser: 4 (System error)
> >Apr 10 13:59:04 ip-10-152-174-17 sshd[22872]: fatal: Access denied for
> >user client by PAM account configuration
> >
> >
> >(client ipa versions)
> >ipa-admintools-3.0.0-26.el6_4.2.x86_64
> >ipa-client-3.0.0-26.el6_4.2.x86_64
> >ipa-python-3.0.0-26.el6_4.2.x86_64
> >
> >
> >(master ipa versions)
> >[root@freeipa ~]# rpm -qa |grep ipa-
> >
> >ipa-pki-common-theme-9.0.3-7.el6.noarch
> >ipa-pki-ca-theme-9.0.3-7.el6.noarch
> >ipa-client-3.0.0-26.el6_4.2.x86_64
> >ipa-python-3.0.0-26.el6_4.2.x86_64
> >ipa-admintools-3.0.0-26.el6_4.2.x86_64
> >ipa-server-selinux-3.0.0-26.el6_4.2.x86_64
> >ipa-server-3.0.0-26.el6_4.2.x86_64
> >[root@freeipa ~]#
> 
> An error is occurring somewhere which is why access is denied. This
> isn't HBAC, that looks like:
> 
> pam_sss(sshd:account): Access denied for user admin: 6 (Permission denied)
> 
> You need to crank up debugging in sssd and see what its logs say.
> 
> rob

What SSSD version is there on the client?

It's possible that it might be a similar issue to one Jan-Frode had with
SELinux.

Rob is right, please raise the debug_level in the [pam] and [domain]
sections and attach or paste the relevant portions of (sanitized) logs.

___
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Re: [Freeipa-users] Issues after setup

[Rob Crittenden]

Shawn wrote:

[root@freeipa ~]# ipa hbactest --user=myuser --host=my.fqdn. --service=sshd

Access granted: True

   Matched rules: allow_all
[root@freeipa ~]#


└─> ssh myus...@ec2-54-xxx.xxx.compute-1.amazonaws.com
 -i
/home/user/.ssh/key
Connection closed by 54x.x.x.x

(client server logs)
Apr 10 13:59:04 ip-10-152-174-17 sshd[22868]: pam_sss(sshd:account):
Access denied for user myuser: 4 (System error)
Apr 10 13:59:04 ip-10-152-174-17 sshd[22872]: fatal: Access denied for
user client by PAM account configuration


(client ipa versions)
ipa-admintools-3.0.0-26.el6_4.2.x86_64
ipa-client-3.0.0-26.el6_4.2.x86_64
ipa-python-3.0.0-26.el6_4.2.x86_64


(master ipa versions)
[root@freeipa ~]# rpm -qa |grep ipa-

ipa-pki-common-theme-9.0.3-7.el6.noarch
ipa-pki-ca-theme-9.0.3-7.el6.noarch
ipa-client-3.0.0-26.el6_4.2.x86_64
ipa-python-3.0.0-26.el6_4.2.x86_64
ipa-admintools-3.0.0-26.el6_4.2.x86_64
ipa-server-selinux-3.0.0-26.el6_4.2.x86_64
ipa-server-3.0.0-26.el6_4.2.x86_64
[root@freeipa ~]#


An error is occurring somewhere which is why access is denied. This 
isn't HBAC, that looks like:


pam_sss(sshd:account): Access denied for user admin: 6 (Permission denied)

You need to crank up debugging in sssd and see what its logs say.

rob


___
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Re: [Freeipa-users] Issues after setup

[Shawn]

[root@freeipa ~]# ipa hbactest --user=myuser --host=my.fqdn. --service=sshd

Access granted: True

  Matched rules: allow_all
[root@freeipa ~]#


└─> ssh myus...@ec2-54-xxx.xxx.compute-1.amazonaws.com -i
/home/user/.ssh/key
Connection closed by 54x.x.x.x

(client server logs)
Apr 10 13:59:04 ip-10-152-174-17 sshd[22868]: pam_sss(sshd:account): Access
denied for user myuser: 4 (System error)
Apr 10 13:59:04 ip-10-152-174-17 sshd[22872]: fatal: Access denied for user
client by PAM account configuration


(client ipa versions)
ipa-admintools-3.0.0-26.el6_4.2.x86_64
ipa-client-3.0.0-26.el6_4.2.x86_64
ipa-python-3.0.0-26.el6_4.2.x86_64


(master ipa versions)
[root@freeipa ~]# rpm -qa |grep ipa-

ipa-pki-common-theme-9.0.3-7.el6.noarch
ipa-pki-ca-theme-9.0.3-7.el6.noarch
ipa-client-3.0.0-26.el6_4.2.x86_64
ipa-python-3.0.0-26.el6_4.2.x86_64
ipa-admintools-3.0.0-26.el6_4.2.x86_64
ipa-server-selinux-3.0.0-26.el6_4.2.x86_64
ipa-server-3.0.0-26.el6_4.2.x86_64
[root@freeipa ~]#




On Thu, Apr 4, 2013 at 5:06 PM, KodaK  wrote:

> Run an hbactest:
>
> ipa hbactest --user=youruser --host=fqdn.of.host --service=sshd
>
> Make sure that works, if it does, then you can move on to troubleshooting
> the host itself.
>
>
> On Thu, Apr 4, 2013 at 2:27 PM, Shawn  wrote:
>
>> Hi,
>>
>> I have configured a ipa-server, replica and client.
>>
>> In the GUI I can see that all hosts are in the "hosts" list.. I have
>> created a single user as well and attached that user to the client.
>>
>> When trying to login as the user to the client, I see this in the
>> secure.log.
>>
>> fatal: Access denied for user  by PAM account configuration.
>>
>> any suggestions on steps to troubleshoot this?
>>
>> Thanks
>>
>>
>> --
>> *- Shawn Taaj*
>>
>> ___
>> Freeipa-users mailing list
>> Freeipa-users@redhat.com
>> https://www.redhat.com/mailman/listinfo/freeipa-users
>>
>
>
>
> --
> The government is going to read our mail anyway, might as well make it
> tough for them.  GPG Public key ID:  B6A1A7C6
>



-- 
*- Shawn Taaj*
___
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Re: [Freeipa-users] Issues after setup

[KodaK]

Run an hbactest:

ipa hbactest --user=youruser --host=fqdn.of.host --service=sshd

Make sure that works, if it does, then you can move on to troubleshooting
the host itself.


On Thu, Apr 4, 2013 at 2:27 PM, Shawn  wrote:

> Hi,
>
> I have configured a ipa-server, replica and client.
>
> In the GUI I can see that all hosts are in the "hosts" list.. I have
> created a single user as well and attached that user to the client.
>
> When trying to login as the user to the client, I see this in the
> secure.log.
>
> fatal: Access denied for user  by PAM account configuration.
>
> any suggestions on steps to troubleshoot this?
>
> Thanks
>
>
> --
> *- Shawn Taaj*
>
> ___
> Freeipa-users mailing list
> Freeipa-users@redhat.com
> https://www.redhat.com/mailman/listinfo/freeipa-users
>



-- 
The government is going to read our mail anyway, might as well make it
tough for them.  GPG Public key ID:  B6A1A7C6
___
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Re: [Freeipa-users] Issues after setup

[Jakub Hrozek]

On Thu, Apr 04, 2013 at 03:27:37PM -0400, Shawn wrote:
> Hi,
> 
> I have configured a ipa-server, replica and client.
> 
> In the GUI I can see that all hosts are in the "hosts" list.. I have
> created a single user as well and attached that user to the client.
> 
> When trying to login as the user to the client, I see this in the
> secure.log.
> 
> fatal: Access denied for user  by PAM account configuration.
> 
> any suggestions on steps to troubleshoot this?

Hi Shawn,

I would start with checking the HBAC rules using the ipa hbactest
command.

$ ipa hbactest --help

might get you started.

___
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Re: [Freeipa-users] Issues after setup

[Rob Crittenden]

Shawn wrote:

Hi,

I have configured a ipa-server, replica and client.

In the GUI I can see that all hosts are in the "hosts" list.. I have
created a single user as well and attached that user to the client.

When trying to login as the user to the client, I see this in the
secure.log.

fatal: Access denied for user  by PAM account configuration.


Did you disable or remove the default allow_all HBAC rule?

rob

___
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Re: [Freeipa-users] Issues after setup

[Shawn]

Rob,

Nope that's still enabled.


On Thu, Apr 4, 2013 at 4:50 PM, Rob Crittenden  wrote:

> Shawn wrote:
>
>> Hi,
>>
>> I have configured a ipa-server, replica and client.
>>
>> In the GUI I can see that all hosts are in the "hosts" list.. I have
>> created a single user as well and attached that user to the client.
>>
>> When trying to login as the user to the client, I see this in the
>> secure.log.
>>
>> fatal: Access denied for user  by PAM account configuration.
>>
>
> Did you disable or remove the default allow_all HBAC rule?
>
> rob
>
>


-- 
*- Shawn Taaj*
___
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Re: [Freeipa-users] Issues after setup

[Shawn]

I am able to login to my replica and master with users no problem, just
having issues with clients..


On Thu, Apr 4, 2013 at 3:27 PM, Shawn  wrote:

> Hi,
>
> I have configured a ipa-server, replica and client.
>
> In the GUI I can see that all hosts are in the "hosts" list.. I have
> created a single user as well and attached that user to the client.
>
> When trying to login as the user to the client, I see this in the
> secure.log.
>
> fatal: Access denied for user  by PAM account configuration.
>
> any suggestions on steps to troubleshoot this?
>
> Thanks
>
>
> --
> *- Shawn Taaj*
>



-- 
*- Shawn Taaj*
___
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users