On (14/11/16 17:25), Ronny Forberger wrote: > > >> Lukas Slebodnik <[email protected]> hat am 14. November 2016 um 17:18 >> geschrieben: >> >> >> On (14/11/16 17:09), Ronny Forberger wrote: >> >> Lukas Slebodnik <[email protected]> hat am 14. November 2016 um 11:36 >> >> geschrieben: >> >> >> >> >> >> On (14/11/16 11:34), Ronny Forberger wrote: >> >> >> Lukas Slebodnik <[email protected]> hat am 14. November 2016 um 10:04 >> >> >> geschrieben: >> >> >> >> >> >> >> >> >> On (13/11/16 16:03), [email protected] wrote: >> >> >> >I found out, that /var/run/sss needed mode 0755. >> >> >> > >> >> >> >But I still cannot use passwords. >> >> >> >My /etc/pam.d/system looks like the following: >> >> >> > >> >> >> What do you meand by cannot use password? >> >> >> How do you authenticate ssh (or login on tty) >> >> >> Are you able to resolve user with "getent passwd" or "id"? >> >> >I cannot login using password or use sudo using password. Neigher by ssh, >> >> >login >> >> >on tty. >> >> > >> >> >I can see the users through getent passwd and id. >> >> > >> >> >The debug log of pam_sssd.so says: >> >> > >> >> > >> >> >Nov 13 17:31:59 macy sudo: in openpam_dispatch(): >> >> >/usr/local/lib/pam_sss.so: >> >> >pam_sm_authenticate(): authentication error >> >> >Nov 13 17:32:01 macy su: in openpam_dispatch(): calling pam_sm_setcred() >> >> >in >> >> >/usr/local/lib/pam_sss.so >> >> >Nov 13 17:32:01 macy su: in pam_get_item(): entering: PAM_SERVICE >> >> >Nov 13 17:32:01 macy su: in pam_get_item(): returning PAM_SUCCESS >> >> >Nov 13 17:32:01 macy su: in pam_get_item(): entering: PAM_USER >> >> >Nov 13 17:32:01 macy su: in pam_get_item(): returning PAM_SUCCESS >> >> >Nov 13 17:32:01 macy su: in pam_get_item(): entering: PAM_TTY >> >> >Nov 13 17:32:01 macy su: in pam_get_item(): returning PAM_SUCCESS >> >> >Nov 13 17:32:01 macy su: in pam_get_item(): entering: PAM_RUSER >> >> >Nov 13 17:32:01 macy su: in pam_get_item(): returning PAM_SUCCESS >> >> >Nov 13 17:32:01 macy su: in pam_get_item(): entering: PAM_RHOST >> >> >Nov 13 17:32:01 macy su: in pam_get_item(): returning PAM_SUCCESS >> >> >Nov 13 17:32:01 macy su: in pam_get_item(): entering: PAM_AUTHTOK >> >> >Nov 13 17:32:01 macy su: in pam_get_item(): returning PAM_SUCCESS >> >> >Nov 13 17:32:01 macy su: in pam_get_item(): entering: PAM_OLDAUTHTOK >> >> >Nov 13 17:32:01 macy su: in pam_get_item(): returning PAM_SUCCESS >> >> >Nov 13 17:32:01 macy su: in pam_set_data(): entering: >> >> >'pam_sss:fd_destructor' >> >> >Nov 13 17:32:01 macy su: in pam_set_data(): returning PAM_SUCCESS >> >> >Nov 13 17:32:01 macy su: in openpam_dispatch(): >> >> >/usr/local/lib/pam_sss.so: >> >> >pam_sm_setcred(): success >> >> > >> >> Those messages are from syslog. >> >> You need to find a problem in sssd logs. >> >> https://fedorahosted.org/sssd/wiki/Troubleshooting >> >Ok, here is the PAM log from sssd: >> > >> >(Mon Nov 14 17:06:41 2016) [sssd[pam]] [pam_cmd_acct_mgmt] (0x0100): >> >entering >> >pam_cmd_acct_mgmt >> >(Mon Nov 14 17:06:41 2016) [sssd[pam]] [pam_print_data] (0x0100): command: >> >PAM_ACCT_MGMT >> >(Mon Nov 14 17:06:41 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: >> >not >> >set >> There are just log messages from debug_level 0x0100. >> >> I assume you set "debug_level = 0x0100" into pam section. >> But 0x0100 is a bitmask style and does not contain debug >> messages with lover debug level. >> >> Could you sed "debug_level = 0x03f0" or non-bitmask version >> "debug_level = 7"? >> >> Please attach log sssd_pam.log and sssd_$domain.log files >> as attachments to the mail. >Here is the log file. > >Best regards, >Ronny >> >> LS >> >___________________________________ >Ronny Forberger >ronnyforberger at ronnyforberger.de >PGP: http://www.ronnyforberger.de/pgp/email-encryption.html
>(Mon Nov 14 17:23:02 2016) [sssd[pam]] [monitor_common_send_id] (0x0100): >Sending ID: (pam,1) >(Mon Nov 14 17:23:02 2016) [sssd[pam]] [sss_names_init_from_args] (0x0100): >Using re >[(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))]. >(Mon Nov 14 17:23:02 2016) [sssd[pam]] [sss_fqnames_init] (0x0100): Using fq >format [%1$s@%2$s]. >(Mon Nov 14 17:23:02 2016) [sssd[pam]] [sss_fqnames_init] (0x0100): Found the >pattern for domain name >(Mon Nov 14 17:23:02 2016) [sssd[pam]] [dp_common_send_id] (0x0100): Sending >ID to DP: (1,PAM) >(Mon Nov 14 17:23:02 2016) [sssd[pam]] [sysdb_domain_init_internal] (0x0200): >DB File for ronnyforberger.de: /var/db/sss/cache_ronnyforberger.de.ldb >(Mon Nov 14 17:23:02 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): >name 'root' matched without domain, user is root >(Mon Nov 14 17:23:02 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): >using default domain [(null)] >(Mon Nov 14 17:23:02 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): >name 'root' matched without domain, user is root >(Mon Nov 14 17:23:02 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): >using default domain [(null)] >(Mon Nov 14 17:23:02 2016) [sssd[pam]] [responder_set_fd_limit] (0x0100): >Maximum file descriptors set to [8192] >(Mon Nov 14 17:23:02 2016) [sssd[pam]] [id_callback] (0x0100): Got id ack and >version (1) from Monitor >(Mon Nov 14 17:23:02 2016) [sssd[pam]] [dp_id_callback] (0x0100): Got id ack >and version (1) from DP >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [sss_cmd_get_version] (0x0200): >Received client version [3]. >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [sss_cmd_get_version] (0x0200): Offered >version [3]. >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_cmd_acct_mgmt] (0x0100): entering >pam_cmd_acct_mgmt >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): >name 'rf' matched without domain, user is rf >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): >using default domain [(null)] >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): command: >PAM_ACCT_MGMT >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: not >set >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): user: rf >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): service: su >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: >/dev/pts/0 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: root >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: not >set >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok >type: 0 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok >type: 0 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 1 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: >36168 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_check_user_search] (0x0100): >Requesting info for [[email protected]] >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending >request with the following data: >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): command: >PAM_ACCT_MGMT >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: >ronnyforberger.de >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): user: rf >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): service: su >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: >/dev/pts/0 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: root >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: not >set >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok >type: 0 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok >type: 0 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 1 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: >36168 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_dom_forwarder] (0x0100): >pam_dp_send_req returned 0 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_dp_process_reply] (0x0100): >received: [0][ronnyforberger.de] >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_reply] (0x0200): pam_reply called >with result [0]. >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_reply] (0x0200): blen: 34 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [sss_cmd_get_version] (0x0200): >Received client version [3]. >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [sss_cmd_get_version] (0x0200): Offered >version [3]. >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_cmd_setcred] (0x0100): entering >pam_cmd_setcred >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): >name 'rf' matched without domain, user is rf >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): >using default domain [(null)] >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): command: >PAM_SETCRED >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: not >set >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): user: rf >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): service: su >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: >/dev/pts/0 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: root >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: not >set >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok >type: 0 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok >type: 0 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 0 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: >36168 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_check_user_search] (0x0100): >Requesting info for [[email protected]] >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending >request with the following data: >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): command: >PAM_SETCRED >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: >ronnyforberger.de >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): user: rf >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): service: su >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: >/dev/pts/0 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: root >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: not >set >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok >type: 0 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok >type: 0 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 0 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: >36168 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_dom_forwarder] (0x0100): >pam_dp_send_req returned 0 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_dp_process_reply] (0x0100): >received: [0][ronnyforberger.de] >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_reply] (0x0200): pam_reply called >with result [0]. >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [pam_reply] (0x0200): blen: 34 >(Mon Nov 14 17:23:07 2016) [sssd[pam]] [client_recv] (0x0200): Client >disconnected! >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [sss_cmd_get_version] (0x0200): >Received client version [3]. >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [sss_cmd_get_version] (0x0200): Offered >version [3]. >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_cmd_authenticate] (0x0100): >entering pam_cmd_authenticate >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): >name 'rf' matched without domain, user is rf >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): >using default domain [(null)] >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): command: >PAM_AUTHENTICATE >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: not >set >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): user: rf >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): service: sudo >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: >/dev/pts/0 >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: rf >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: not >set >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok >type: 0 >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok >type: 0 >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 0 >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: >36187 >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_check_user_search] (0x0100): >Requesting info for [[email protected]] >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending >request with the following data: >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): command: >PAM_AUTHENTICATE >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: >ronnyforberger.de >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): user: rf >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): service: sudo >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: >/dev/pts/0 >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: rf >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: not >set >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok >type: 0 >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok >type: 0 >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 0 >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: >36187 >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_dom_forwarder] (0x0100): >pam_dp_send_req returned 0 >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_dp_process_reply] (0x0100): >received: [9][ronnyforberger.de] >(Mon Nov 14 17:23:09 2016) [sssd[pam]] [pam_reply] (0x0200): pam_reply called >with result [9]. authentication for "sudo" failed here. 9 is a return code from PAM_AUTH_ERR. I could also see the same problem with authentication for "dovecot" service and the same user "rf". But I could not see any attempt for authentication with ssh or login(tty). I would recommend to start testing with something simpler rather then sudo. BTW more details shoudl be available in domain log file https://fedorahosted.org/sssd/wiki/Troubleshooting#TroubleshootingAuthenticationPasswordChangeandAccessControl LS _______________________________________________ sssd-users mailing list -- [email protected] To unsubscribe send an email to [email protected]
